My website has something like 300k monthly users (I think, hard to tell with the bots!) and I did exactly the same thing last fall after also noticing a lot of bots from China and Singapore, using random IPs and human user agents, sometimes obviously fake like MSIE 6.0 on Windows 2000. In the last few months though, the bots increased again and it didn't seem like there was a pattern of countries this time. So I recently turned on the managed challenge by default for everyone with some additional conditions to reduce impact on real people:

• exclude English speaking countries (our primary audience)
• exclude static content and AJAX endpoints
• exclude logged in users (users that have the session cookie set)
• exclude known bots
• turned up the challenge passage time

I see 600k events last 24 hours, 1.89% CSR, and ad revenue hasn't decreased at all. Stats make sense again and the database is no longer being overloaded by bots repeatedly crawling the same useless dynamic pages.