PS: the output of the users getting the problem was a page with url /profil/saveregisters with a js alert saying that the session had expired or the cookies were not activated on the browsers. Same thing with firefox, edge or chrome. Switching to internal spam mode solved it

This shouldn't be possible anymore unless their Joomla session expired. We don't use separate cookies or sessions anymore with CB. We just use Joomlas session now. I suppose it's possible they sat on the page so long their guest session expired then they submit the page and hit this issue.

Will review reCaptcha code next week as I don't have time to do so before the weekend and see if something is going wrong in the reCaptcha code. If the captcha fails it should just throw a normal registration validation error. It shouldn't be throwing a spoof check error.

Was able to confirm issues with reCaptcha Invisible and reCaptcha v3. Both will require the form to be submit within 2 minutes of access it or they will fail. I'm rewriting their usage entirely to strictly only act on form submit behavior so this won't happen anymore. I don't see any issues with reCaptcha v2.

Yes, in latest CB AntiSpam build and in latest CB build released today this is now fixed. I've completely rewritten reCaptcha v3 and Invisible to be more reliable. I didn't find any issues with v2. v3 and Invisible will now properly only execute once the form has been submit and only if the form is valid this prevents that 2 minute timer from ticking down while still completing the form as Google expires the tokens after 2 minutes.