The choice of human-accessible questions could be opened up. A page scanner to avoid the use of shortcodes could be offered.
A fairly hefty change to the way the CAPTCHA is placed on the frontpage. I had made a bad assumption about how a WP hook worked, and rectifying it required engineering a vastly more fiddly piece of apparatus requiring parsing and fiddling with the document. It ought to be as close to bullet-proof as can be, much better the regular expressions.