If it's Cloudflare issuing the challenges and not the forum then yeah, the VPN could be the problem. An awful lot of sites use Cloudflare and all they will see is an awful lot of connections from the VPNs IP pool so suspect bots. TBH actually using a recaptcha is good, a lot of hosts would used to just drop all connections from those IPs for a while. Sometimes that lead to whole towns or even countries been blocked from certain sites due to one or two arsehats, especially in the days of dial up or early broadband.