Or perhaps there is active malware within the NHS network? Why is the immediate assumption that the amount of traffic is not actually an indicator something is wrong?

When I've managed office networks and we've seen the captchas, every time it was traced to actual infections of a few machines. Re-imaging them (and educating users) fixed the problem.