Leading zero bits (which is different from leading zeros, for clarity).

Spam will be coming from servers. The reasonable compute for a server to generate POW is where the minimum gets set.. client devices just need to match it.

Dynamic POW requirements based on content or publishers are also possible.

We won’t know a real number until it’s used in the wild. It depends on how much spammers / advertisers are willing to pay extra to get their events accepted.