A common question on the CF forum is a requests/second trigger for either enabling Under Attack mode or enabling a Firewall rule that triggers the full hCaptcha page. This is most likely what happened here.

[This is usually done by counting requests/second at the origin then using the CF API to enable the firewall rule or change the security level)