Badly configured bot protection. It'll look at user agent headers and try to fingerprint the browser (some form of fpjs2 or similar,) and then decide. Very error prone.