edit: @Almightyruler - taking to recaptcha with a flame thrower is on the to do list, quite close to the top even.
recaptcha isn't so much the problem - although it has become more and more difficult to solve over the years - it's the routine use of
any captcha when logging in...
Possible solutions:
1. Whitelist IPs which have successfully logged in previously. If there's any funny business (submitting invalid u/p), revoke that whitelisting, and require captcha for that IP.
2. Whitelist browsers which present a signed cookie/token. Again if there's any sign of potential bruteforcing, revoke the whitelisting, and require captcha.
Putting it simply, if a browser loads the site with some basic proof that it has been used by a customer for previous authenticated access, assume they're a customer, unless something happens to suggest otherwise.
Recaptcha really hates me, probably because I go through a private VPN that uses datacentre IPs, and I regularly delete Google cookies.