For software with client-side exposure that can be discovered during scraping, BuiltWith has pretty solid coverage (at least when I used it ~1 year ago).
I don't know if those services do it, but you can also find some really useful intelligence from DNS records. From email and calendar provider data to third party services like analytics trackers and landing page service providers (such as Unbounce). If you have an app that integrates or competes with those services, it can be really useful. If you use a DNS lookup service that provides historical record changes, you can even time your outreach to coincide with their annual renewal period when they're most likely to be entertaining the idea of a switch. Or in the case of an integration, wait until after the renewal period to start outreach since you know they're locked in for another year at least.
You can also use DNS records to link together entity ownership relationships. Say a company has competing product lines and doesn't overtly market them as owned by the same company. If they happen to use Salesforce Communities, the CNAME for the Salesforce community subdomain will be specific to each site but will have the same Salesforce account id in it, Now you know that they're operating under the same entity, which itself is useful intelligence, but you also can combine the technology usage you sniffed from both sites together.
Where automated form submission would come in really handy would be a competitive intelligence tool that scrapes an entire site (and subdomains), identifies what actions on which page trigger which tags, and stitched together entire marketing funnels. Being able to monitor a competitor's likely marketing funnels (and seeing which ones they keep over time and which change) would be incredibly valuable, and would necessitate knowing precisely which tags fired on every page, including post-submission pages.
You're right that universal tags and the event naming that you could parse from the JS could be very valuable, although it would be hard to normalize.
And you're totally right about stitching together marketing funnels for lead gen conversions, but I'm not sure how you would get that from an ecommerce setup short of making a purchase and refunding it (which might be impossible to do in many cases).
Part of me has wondered if there are any partnerships BuiltWith or others have with popular browser addons. I imagine if they snooped this somehow from users, it would be valuable to them (setting aside whether it is ok to get this level of data).
I played around with someone's open source version of BuiltWith (forgetting what it was called) a while back and it was pretty cool to see how it works. I'm not a developer (although learning to code), but I've done similar research manually as part of my job, so this is really interesting to me to see what else can be learned.
For example, if there's a publicly traded ad tech company and you know a substantial customer of theirs just removed their tag, or many customers did in a certain time frame, you could short their stock (or vice versa if you see huge growth).