#1. IP limiter #2. Heat Map #3. Limit number of battles you can play each day #4. Hidden invisible recaptcha (no one would see it) #5. Honeypot trap. #6. VPN blocker. These are just a few methods that would easily stop 99% of bots lol.

So if I invest in a VPN service I'm out?

Also, some mobile internet networks popular in various global regions give new IP addresses every time they connect.