When deploying this plugin, I noticed that I was getting asked for a captcha per router; and the verification state was getting lost quite often.
After digging into it, it appears that an instance of the plugin is created per route, which means different states per instance, and the timers are causing each instance to override the same persistence file.
I, with my very limited Go knowledge, worked around this by implementing locks on the file, reloading the state file more often, reconciling the state on load, and saving more often. Works well from initial testing, although I think I will have to serialize the expiration dates into the state file. I keep the persistence file on a ramfs for obvious reasons.
I'm not sure if my changes/requirements fit the goals of this project, but here they are in case you'd like to take a look(and hopefully implement them in this project!): https://github.com/dararish/captcha-protect