Pretty neat. From an isolated POV, they could examine user behaviour on the page, look at mouse movement, speed at which a forum is filled out, time on page...
But if you think outside the box, Google could be using cookies to build an online profile based on your behaviour. That same cookie hits the noCAPTCHA, the server will respond with an aggregate result of that behaviour...
At another job, I thought about this sort of thing (albeit it did not go much further than that). Even if a user clears their cookies, you can still piece it back together:
- Cookie:
abcdef
accesses site, logs in to uid 123, builds some profile data based on behaviour
- User clears cookie
- Cookie:
foobar
accesses the site, logs in to uid 123, builds more profile data, aggregated with the behaviour data gathered earlier from abcdef