Google's search ranking algorithms are commercial secrets, so it is hard to prove one way or the other whether they are rationing clicks. However, we can do some simple statistical analysis that gives us an indication of whether this may be the case.
If Google was not rationing clicks, we would expect the distribution of clicks over time (e.g. per four-week = 28-day period), to approximately follow a Poisson distribution — unless traffic events are not independent, in which case they would arrive more bunched together, e.g. around events that are relevant to the Web site. But in any case, if the traffic data are much MORE constant than the Poisson Distribution suggests, then we can be reasonably certain that Google is rationing links: because any interdependence between traffic events, or "organic" traffic growth over time, should make the distribution LESS uniform, not more! In other words, for a Web site receiving an average of 20 visits a month (with randomly distributed Web traffic events), we would expect per 28-day period (on average):
1–5 visits .007% of the time
6–10 visits 1.07% of the time
11–15 visits 14.57% of the time
16–20 visits 40.26% of the time
21–25 visits 32.87% of the time
26–30 visits 9.87% of the time
30–35 visits 1.27% of the time
etc. On average, we would expect less than 16 visits, during at least one 28-day period in every seven. We should expect at least 26 visits, during at least one 28-day period in every nine. But this is not what I am seeing: instead, for several years, my inbound organic search traffic on the site I'm investigating, has never been less than 16 or more than 25 per 28-day period! Traffic is almost perfectly constant. Every 28-day period, in a rolling window or sequentially (it makes little difference), almost without fail, I have exactly 18–22 clicks: never less than 16, and never more than 25.
I've seen the same pattern previously on other Web sites I've developed: anecdotally, it seems like when you first create a Web resource, Google crawls it. When everything is tidy (no major reasons NOT to transfer traffic, and when the site has several decent pages of unique content), they start drip-feeding your site with a little traffic at a constant rate. Once your site has a few dozen decent pages of unique content, and starts building a reputation with some good quality inbound links & organic traffic that doesn't bounce straight back to Google; suddenly, traffic seems to jump from consistently 20 visits per month, up to a hundred or more! It is precisely as though Google's internal safety-limits are being progressively removed.
Anecdotally, we're seeing evidence that Google is rationing clicks per Web site. They also have a potential commercial motive to do this: out of sheer frustration with our long-time inability to break through their apparent click-rate ceiling, we have both gone in search of answers to this question, and in the course of our search for answers, come across Google's advertisements and tutorials for their "paid search" auctions/ services. Whether it's actual Google business policy or not, to do this; search algorithms are such tightly held commercial secrets (necessarily so, to help obstruct black-hat SEO), that it might even be possible for some mid-level technical managers to subvert their algorithms into behaving like this in order to nudge more Webmasters into paying Google, out of sheer frustration!
Potentially benign motives for this behaviour might include: to buy time for Google engineers to analyse any Web sites that suspiciously start ranking much higher than they should (pulling them apart for signs of black-hat SEO, before modifying their core ranking algorithms to demote sites on that basis). It's quite possible their ranking algorithms have various layers of defence: core algorithms for analysing quality×popularity, and safety-valves to buy time in their arms-race with the black-hats and to obfuscate the workings of their core algorithms from prying eyes (e.g. probing attacks by competitors seeking to reverse-engineer Google's secrets).
Based on comparison of Poisson distribution to the actual time-distribution of search traffic transferred to the Web site I am investigating, I might calculate a maximum probability that Google is not manipulating traffic in this way (I estimate that this probability is very small). However, the actual real-life distribution is so constant as to make it almost pointless doing the calculation — and in any case, Google only lets me see 90 days of history in their Search Console! (I wonder why…) Personally, I think their policy is unfair to small businesses that are apparently being made by Google to traverse artificial deserts in search of an oasis of Web traffic — potentially in part, to artificially make their paid advertising services more desirable!