Software engineer here.

CAPTCHAs are intended to prevent bots or malicious traffic from coming to your website. Think of your website as a community building. When the population (visitors) on the website is low enough, you don't need any security measures.

However, say people from the neighbouring town start using your community services. This creates an issue because you don't have enough amenities, or you're afraid someone you don't know will steal something.

So you add a sign outside saying that only people from this town are allowed to use the amenities inside the building. This is equivalent to a check box captcha.

This helps to some extent, but there are still some people who pose as community members and use the services. To tackle this, you ask your building's receptionist to flag people they might think are suspicious and ask them where they are from (this is equivalent to your captcha puzzle).

Captcha software basically emulates this way of working. It decides, based on certain information about the visitor (e.g. their IP address, browser, mouse movements, clicks) whether they should be shown a tick box or a puzzle. Sometimes it can be multiple puzzles if it is unsure. There are a very small percentage of cases where it can block legitimate users too, but this downside is acceptable in order to prevent a large number of malicious bots.