it's hard to separate spambot that only accesses 3-5 links per IP and a legit user. Changing content for legit user can be devastating

Put a cookie wall in front. The bot will either load the cookie and have a persistent identifier, or not load the cookie and not get in