Exposing the correct position for each round to the client is certainly not a good idea
You are currently exposing the correct position (lat, lng) for each round through the publicly visible api. There are alot of users and bots that are abusing this and I don't think it's even necessary.
The client doesn't need to know the correct position for the round, just validate the position on the server side. That woud probably eliminate 90% of the bots.