Depends entirely on the niche and traffic source. I have abandoned some niches because even with automated, realtime suspension of campaigns/referrers, there were so many bots (more than 50%) that I couldn't make the niche profitable. There are two primary sources for bots that click on PPC ads: competitors looking to drain budgets, and site owners looking to profit by having bots click on their ads. The latter is the easiest to defend against, since you can simply blacklist their site(s), plus any other sites that are likely on the same server (fortunately, most criminals are pretty lazy/cheap in this regard). I know one marketer that auto-blacklists all domains that have private Whois information after 1 click, and he has done very well with that.
To answer your question, based on my personal experience, I'd say on average, for display campaigns (specifically not referring to Google search ads, which tend to have a lower percentage of bot traffic - while Bing is the Wild Wild West)...I'd say overall it's somewhere in the 30% neighborhood. Not all of those have malicious intent, but in PPC, every non-human click on your ads is malicious.
Regardless of niche, realtime bot mitigation is probably the best competitive advantage that one can have in the PPC arena.
To answer your question, based on my personal experience, I'd say on average, for display campaigns (specifically not referring to Google search ads, which tend to have a lower percentage of bot traffic - while Bing is the Wild Wild West)...I'd say overall it's somewhere in the 30% neighborhood. Not all of those have malicious intent, but in PPC, every non-human click on your ads is malicious.
Regardless of niche, realtime bot mitigation is probably the best competitive advantage that one can have in the PPC arena.