It's good that the draft is already noting the privacy concerns with using Google CAPTCHA services where Google is specifically collecting lots of browser data. Some specific things it might be good to note:
if being "logged in" to a Google (or other large IdP) service is considered the primary route around CAPTCHA challenges, there will be a dramatic shift in the burden on completing challenges to people who may take privacy precautions in their browsers (like limiting the scope of cookies) or who don't already rely on the particular service provider for other services
it would be worth noting that one particular privacy implication is that the large IdP (Google or other) is given not just data on the user's browser, but data about what the user is trying to do on the host site. And especially where the CAPTCHA is being provided by a third-party that requires an identity verification and authentication, this means that the third-party can connect your identity to what you're reading or what service you're accessing on that other site. Alternative protocol designs could prevent this kind of connection, but more broadly, individual identity authentication is not the same as verification of being a human.
It's good that the draft is already noting the privacy concerns with using Google CAPTCHA services where Google is specifically collecting lots of browser data. Some specific things it might be good to note: