Hmm, you have a point. They are US third party services collecting user data.
However, I don’t see reCAPTCHA as compliant in spirit, even though it may be strictly speaking.
Site-specific, there doesn’t seem to be much harm in having Google (an advertising agency) load a javascript and see what forms people are using.
User-specific however, they use it to track users accross all kinds of websites and submitted forms and build up a database with that user info. I don’t think that is very much in line with the intention of the GDPR.
Again, I do not plan to integrate reCAPTCHA, since I think it is a user hostile service. If you really do want it, it is possible to write a plugin that adds it to Gwolle.
About the spam, you could just play a bit more with the anti-spam features. If Akismet and Stop Forum Spam are not right for you, there is the Custom Quizz Question, which should be much better than a captcha, and still more userfriendly.