Captcha is likely being triggered by Cloudflare. We have heard this feedback in this past and have listened but it's always a tricky balance of fighting abuse/bots and presenting an extra step for the user.
I put this on my signup form and have had zero spam since, and it has very little impact on user experience. The fact that it doesn't feed the google surveillance machine is a bonus.
what are they doing on namecheap? buying domain names?
(if they're hitting your domain checker you can configure cloudflare to only captcha protect that page...)