Direct SQL access to the events is the bit I'd actually use. On our job board the raw logs turned out to be mostly not people: AI crawlers and scrapers hit listing pages all day, and the headless-browser ones run the JS snippet like any visitor, so a script-based tracker counts them as sessions and a slow week can look like a traffic spike. Having the raw rows in our own database is what let us spot it and write the filter at all. Do you drop suspected bots before the insert, or store everything and filter them out in the views, so people can change the rules later?