As they did in the judgement I linked to.
A judge can always claim you could have used a local version of whatever external resource you used.
YOU provide the service so YOU are responsible for the way your user's data are processed and must ensure that it's processed according to the rules (requiring consent when necessary)
If you can use a local version of an external resource, you should. Minimisation is an integral principle of GDPR. There are plenty of circumstances where it would be impractical or impossible to perform a necessary function without sharing data with third parties, but that still needs to be done with appropriate thought and care.
I would have a great deal of confidence in embedding a resource provided by Stripe; I would have absolutely no confidence in embedding a resource provided by Google.
All GDPR is asking mostly is: you only gather minimal PII to provide a service (if needed at all). If you use PII for another purpose than providing the service or meeting operational purposes (like fraud detection or monitoring your infra), then you must obtain the consent of the user (for marketing or selling your users data for example). This extends to your providers too (like Google Analytics...)
The problem is that a lot of "internet services" take for granted that they can do whatever they want with the data they got for a specific purpose... even without informing the user! And that's not good... so GDPR has been created.
But if your service is "fair" to the user (meaning: you only use the datas to provide the service), then there's no problem...
Yes it's selling: You provied the data, Google gives you hosted services back. If you think embedded fonts are useful for you, you can host them. Then you pay the bill and not your users.
reCAPTCHA, in this case can be consider as "fraud detection".
Can we do it without PII? Yes. Maybe. With lots of effort and less optimal result.
Does this fit the "necessary" provision of GDPR? This depends on which court you ask.
reCAPTCHA does not add "direct" value to the user, it even cost some harass... but it is a life saver if your service is big spam target.
There are six lawful grounds for processing personal data under GDPR; only one of those grounds is consent. Consent is not always necessary, nor is it always sufficient.
An IP address is potentially personal data, because it could relate to a natural living person. There are all sorts of legitimate reasons to use that data without consent, the most obvious being to fulfil a request by the user. You will run into issues if you're using that data in ways that aren't strictly necessary - keeping logs indefinitely, using that data for marketing purposes, sharing that data with third parties without good reason and without adequate safeguards etc.
https://gdpr-info.eu/art-6-gdpr/