HTTP Status Code for Captcha

For me 422 is somewhat accurate for this case:

response status code indicates that the server understands the content type of the request entity, and the syntax of the request entity is correct, but it was unable to process the contained instructions.

You may want to consider status code 429, defined in https://www.rfc-editor.org/rfc/rfc6585#section-4.