@PaulaKreuzer asks in https://community.metabrainz.org/t/why-are-we-still-using-g-e-re-captcha/417340 if we can replace our (Google) reCAPTCHA with a non-Google one, and even gives a few possible alternatives (never mind that two are apparently in PHP):

• https://www.phpcaptcha.org/
• https://metacpan.org/release/Authen-Captcha
• https://www.phpclasses.org/package/3193-PHP-Generate-CAPTCHA-validation-images-with-effects.html

Edit: The selected alternative is MTCaptcha which is GDPR-compliant and accessible. Moreover, they do support us as a non-profit through their free enterprise-grade plans. See the linked ticket MBS-13146 for more details about the reasons behind this choice.