2 of 2 Removed use case for users already logged on because it was not pertinent to the question.

The preferred solution depends on your resources (CPUs, bandwidth, latency) and on the number of hashing iterations used. Also consider that external CAPTCHA services may intentionally blacklist or throttle servers which generate too much traffic.

I second ximaera's answer on the dangers of free services and other answers on the need to implement network DDoS defences.