from the server (which is the only one you shall trust) captchas are a challenge sent as some bytes in a http request, and then returned later as some bytes in a http request. What the client does with them should be hard for a computer. It may involve javascript, clicking on images, hearing something and entering as text or solving the 3rd riemann conjecture. You cannot prove the javascript has even be interpreted client-side. All you can be sure is that the naswer is correct and that it's hard to do by a computer.

The problem is that we're quickly running out of things that:

1. can be done by humans most of the time

2. cannot be done by machines most of the time

3. fit into the workflow of a web form

Point 3 is the interesting bit: You cannot build a captcha that tests dexterity, emotional intelligence or creative problem solving but is still accessible to a large internet audience.