But for the business, bot protection is essential. And GDPR talks about business perspective.
It has to be essential and unavoidable for the delivery of the bytes to the browser, or it has to be essential for the requested functionality.
The UK ICO has some pretty good guidance. I'd not be confident at all arguing that recaptcha is at all essential under PECR, even though it may be a legitimate interest under GDPR. Important to note that PECR/ePrivacy directive actual goes further than GDPR when it comes to the cookie rule, and you can't use legitimate interest as a basis here!
https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...
"This means you are unlikely to need consent for: - load-balancing cookies that ensure the content of your page loads quickly and effectively by distributing the workload across several computers."
You can put a lot of things in this exemption list. I risk to say, even Google Analytics.