The timing of the click captcha loading is randomized and it probably is looking for human-ish cursor movement? (Like you’re probably moving your hand in imperceptibly small ways that are difficult to replicate). Clicking before it loads and doing it repeatedly probably triggers detection.
If I understand it correctly, it’s “federated” in the sense that you can create similar infrastructure to Bluesky’s using ATProto and have your posts show up there, but that reality seems pretty academic because not many people are doing that compared to Mastodon.