The bot filtering is the part I'd look at first. On our job board every redirect to the original posting counts as an application, and for a while a big share of those clicks came from cloud servers, Google Cloud and AWS, sending a normal desktop Chrome user agent. Our UA list missed all of it; what finally worked was checking the click IP against data center ranges. Does Snipzr decide a click is a bot from the user agent alone or from where it comes from too, and can I see how many clicks it dropped?