So the response I got to the ticket after some back-and-forth with them was that an unusual amount of bot activity most likely triggered the firewall to cause the captcha requests. Please let me know if you continue to see the requests it may take a little time for them to stop if the site continues to get hit.
Thanks for filing the ticket!
I mentioned elsewhere that I admin a site and have put Captcha3, set to very low settings, only on the registration page. It has worked a treat to rid me of the task of weekly clearing out the would-be spammer accounts and I've received not a single user complaint.
It was easy to implement on the site I run because the site is built on WP and I use Ultimate Member. On that plug-in it's just a matter of registering the site with Google, copy-pasting a key, ticking a checkbox, then specifying what page to run it on. Took me about 5 minutes. I'm not at all sure that XenForo makes it that easy, but if it does it would be something to consider. Previous Captcha versions sucked, and I wouldn't use them on the site, but 3 is darn slick.