I'd assume some VPN IPs have suspicious reputations on the CF network, so they could be subject to more intrusive checks, like CAPTCHAs.