Sites that use CAPTCHAs typically tolerate a certain failure rate for humans, but may lock out access from an IP if the failed attempts exceed a threshold.
Welsh Government officials, who've had access to the statistics for years, remember, refused to put any sort of threshold as to when they might look to step in here.