It uses other signals too, like what other sites you’ve visited with that checkbox on it, what CloudFlare has seen your IP address doing in the past, etc.
The google one is able to see if you’re logged into a google account and take that into account.
There’s even a new variant of the Google captcha that is invisible and doesn’t even bother to show a checkbox.