Simply read jagex's privacy policy. They have the legal right to get your computers hardware specs, including MAC address which is a unique address to your specific device. Unless you are changing this either with a high end proxy (each proxy will have its own unique MAC address or manually changing it within CMD, jagex will know its the same device. If this device's MAC address is already flagged, its pretty easy to be banned even with changing IP/proxy IP). The timezone DOES matter. They have lots of data on the average players playtime vs specific timezone. If you are constantly playing at irregular times than the average player, its a flag (not a big one, as people do shift work, but a small flag nonetheless).
If you are botting just a single account. Just reset your IP/MAC address in CMD, takes like 30seconds and it'll keep it a safe residential one that has less chance of being banned.
Like Defiled mentioned, the ISP/proxy server address may already be flagged which is a pretty easy way to catch other accounts. Thankfully Brazil has a location based legal right and Jagex abides by it (just read the privacy policy). IMO spoofing Brazil has resulted in less bans than most countries.
Jagex is also able to read the time of your computer, meaning that if you're spoofing a timezone that your computers time isn't set to, they can detect you're not actually there, even if its a residential proxy. I know this as until I modified my computers time to the same as the VPN location, I wasn't able to create an account on their website (for a few proxy IP's, not all).
They aren't doing anything that they don't claim in their privacy policy or they face being sued, and tbh they give away lots of information on how to avoid being detected within it too.
Once you have beaten all of their hardware / software checks, it really just comes down to how long you bot for / the quality of the script, like many have said above.
