This is the reason why I usually don't ban servers on RuneLocus. This used to happen a lot on my website, be careful on this Kevin.
First point is completely true, the second not lol. I haven't made such changes in years.
Technically seen it is definitely possible and pretty easy to stop vote bots... but just for a day or two. The developers of those bots will find a new way to trick the system before you get to celebrate your update. It really isn't worth the time to block vote bots, I gave up on that years ago. It'll become an unending routine of updates, and eventually a total waste of your time.
Instead of trying to stop vote bots, I moved onto just moderating the toplist. Works better for me, because my systems are able to detect almost all common vote bots as you can see.
But instead of blocking them like we've all been focusing on for the past years, I just let them vote.
Then at a random moment, I just suddenly remove (parts of) the cheated votes. Or even better: I let the system automatically remove the votes when they're (finally) about to beat another server in rank. It's great to see a cheater almost about to celebrate beating a (not cheating) competitor, but instead of sending it up in rank, send it down in rank. Karma.
That unfortunately does mean my toplist isn't 100% clean, obviously. But I don't think that's much of a problem. I'd rather have 10% cheated, than have 95% cheated (e.g. RSPS-List.com). Besides, this is obviously a lot easier for me, and a lot harder for the vote botter. They can update their bot to whatever they want after I remove the cheated votes, but they'll never know whether I'm still able to detect their votes or not until I remove the votes again.
Annoying and disappointing the cheaters seems to be the best solution these days. Server owners really respect the moderation, try to help me out by giving me tips and information on cheating software and eventually leak cheating scripts to me. So yes, it is worth to look into the toplist Stuart. Just not to block, you're right on that.
I haven't used reCAPTCHA in ages, instead I use FunCaptcha. It doesn't help stop vote bots at all though, don't bother getting it lol. I have it for other reasons.
Developing a bot to create some fake forum accounts is easy, doesn't solve the issue but will cause votes to drop to a minimum. Nobody is going to register an account to vote.