I wonder is it a good idea using captcha when using an anti-CSRF token on login page? I think it's impossible for robots to mess with login page because the token changes on every request.
Yes its neccessary. A token can still be requested by a bruteforcer. Yes, it would cost the bruteforcer one request extra per try, but a captcha still blocks attempts completely instead.
If you dont want to bother your users with a captcha, you could set so when a incorrect password is used, the account in question will require a captcha. This both thwarth bruteforcers, but also alert the original account holder, that someone might try to access his account. To avoid that a bot might figure which accounts that exist or not, store this flag also for non-existing accounts.
CSRF tokens aren't intended as a protection against bots at all. They're only intended as a protection against CSRF attacks. It's only coincidental that some bots don't handle CSRF tokens correctly, but many do. If you're worried about bots, then you should still use a CAPTCHA; the presence of CSRF tokens should not influence your decision on that.