This is a really intriguing idea. What would stop a spammer from taking the time to get a single token and sharing it among a pool of bots?
There are protections against replay attacks within mCaptcha: tokens are single use also have a lifetime beyond which they are invalid.
Disclosure: author of mCaptcha