point is, why do you care if your site can handle the traffic?
there's no (malicious) bot detection that won't impact a portion of real users. accept that fact and just let it be.
poisoning data in ways that's obvious to the false positive user is a much better option.