I'll vote for PoW on all events, a simple requirement 000 prefix on the event id together with a nonce on top-level.