Hi Wayne,
Here’s a post on this topic. Some bots will be easily identifyable via the useragent, others won’t. Both Christophe’s post and Yali’s comment should give you a good idea of how to use Snowplow fields to determine what’s legitimate.
There’s also an open issue on using the IAB/ABC bots and spiders directory in an enrichment to exclude them.
Hope that’s helpful.
Best,
Colm