When placing cookies, the bar to essential is actually really high.

It has to be essential and unavoidable for the delivery of the bytes to the browser, or it has to be essential for the requested functionality.

The UK ICO has some pretty good guidance. I'd not be confident at all arguing that recaptcha is at all essential under PECR, even though it may be a legitimate interest under GDPR. Important to note that PECR/ePrivacy directive actual goes further than GDPR when it comes to the cookie rule, and you can't use legitimate interest as a basis here!

https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...