To your first point, I cannot believe there will be much 'bot' traffic to a URL that is only declared within the HTML code embedded in an app. The primary goal of spambots is to plant links back to other sites, and there's not much point doing that on pages that are not themselves indexed, and no point at all on forms that do not affect content.
Whilst it is possible to disassemble the app or sniff the requests, there would need to be some purpose to a bot created from the information. If the objective was simply to swamp your server with traffic, sending incorrect CAPTCHA data often enough would be sufficient. Without knowing what you seek to protect, I cannot say whether a CAPTCHA is necessary.
As the only known purpose of the CAPTCHA is to comply with a robotic request from the specification drafters, a sufficiently foolproof CAPTCHA would be the following text instruction:
Please hold your device in your left hand.
As we all know, computers do not have hands and always follow instruction so when faced with this they will probably like self-destruct or something. Stands to reason.
(This is mobile-centric as desktops are typically too heavy to hold in one hand.)
This text genuinely ticks all the key boxes for an alternative CAPTCHA:
- Delays completion of the form by all humans
- Alienates the disabled
- Makes zero difference to the form fields submitted, thus requiring no server-side programming
- Is easily circumvented by anyone with genuine malicious intent
just like other answers here, like the one where you have a slidey thing because computers don't have fingers.
An enhanced version of this would be to place the word
left in a blurry image of a particularly hard to read font in an eye-watering colour combination, which will achieve: