The statistical methods can detect things orthogonal to performance KPI’s. Automation has “tells” - little things they do differently from what humans would do. Reliably discriminating those signals is a hard problem.

> Automation has “tells” - little things they do differently from what humans would do

This tends to stand out like a sore thumb once you start looking at things from the perspective of the frequency domain. Even if you use an RNG to delay activity, the properties of the RNG itself can be leveraged against it. You may think taping a pencil to a desk fan and having that click the mouse button is being clever wrt undetectable RNG, but you must realize that the power grid runs at 50/60hz and induction motors are ~fixed to this frequency.

There is also the entire space of correlation. A bot running on random pixel events with perfectly human response times, while appearing "random", is not correlated with anything meaningful outside that one pixel being monitored. You could check for what are effectively [near] causality violations to determine the probability that the player is actually human.