Flag in x-analytics in varnish any request that comes with no cookies whatsoever.
We can use the fact that the request comes without any cookies as a proxy to identify bots, this method will catch users browsing with cookies off (a minority) and users with a clean slate browser session (such us Chrome incognito mode) . Currently we identify bots using the user agent but we know we are missing a great number that cannot be identified this way.