It's a PHP script that gets some info about the user then responds accordingly. There are two ways to do it:
1. Browser user-agent.
When you use a browser, it has a special code that identifies which browser it is. Google's auto-verify bot for AdWords has the word "AdBot" (I believe, could be something different; I don't remember) in the user-agent, so you can detect this with PHP and display the landing page for the bot. This only works for the AdWords bot. If an employee visits your page manually, they will go to the CPA offer.
2. Referring URL
Perhaps better because you can deter both Google employees and the bot. When you visit a site, some data is sent along, including where you came from. When you click on a Google ad, then URL you click is "www.google.com/aclk" followed by a long string of characters. So if your user comes from that link, you can redirect them to the CPA offer because you know they legitimately clicked your ad. Otherwise, the user will see your landing page, i.e. if an employee goes straight to your site or the bot visits your site.