They have junk ads (extremly low RPM due t olack of purchase power of faucet visitors) - mostly scams, ponzi schemes, unfair gambling, etc.
And you also solve captcha for them. They either rent your HUMAN ROBOT captcha solving capability to spammers or use the solved captchas to spam other websites themself.
But they often mine XMR/ETH with extremly unefficient javascript webbased miner (less than 10% hashrate in comparison with XMRcgpu)