I'm guessing a lot of them use reCAPTCHA, and according to this comment, reCAPTCHA uses an obfuscated VM:
https://news.ycombinator.com/item?id=43748994