If they got rid of the third party services (in this case, Google ReCaptcha and Google's CDN) they would be fine with their current implementation. First party

If they got rid of the third party services (in this case, Google ReCaptcha and Google's CDN) they would be fine with their current implementation. First party cookies that are necessary do not require any form of opt-out, and a notice about them is compliant. They are not using any third party tracking for marketing (as far as I can tell). Most businesses are using cookie opt-in regardless of the specifics of their usage because businesses are risk averse, but there is nuance, and it is not an absolute requirement.