You don’t stop botting by going after the bots; you stop botting by going after the people behind them. Remove the botters, and the bots will wilt and wither away.
How do you do this? Possibly by requiring players to tie their real-life identities to their accounts. That doesn’t mean that this information is made public, just that the developers have access to it. Right now, in this game (as in many others), it’s possible to play completely anonymously, without needing to provide any sort of info to be able to use full-featured accounts. Bots thrive in this environment.
Of course, going down this road has a host of its own issues, such as, well…Losing big chunks of your player base for one.
But you can’t truly combat bots any other way. You can never defeat a combination of VM and VPN. As soon as you take out a bot, a new one will take its place minutes later, appearing to come from a different computer in a different location. And any measures similar to what the OP proposed will just be automated as well.