Hi! You're simply ... wrong. Please, dive into js just little more deeply. doneClicked does nothing except disabling 'done' button
Which if overridden would make it not disabled. You're an entirely client-side solution near as I can tell -- and that means it can be slapped aside as if it wasn't there with ease.
Unless you're sending all that server-side for validation somewhere I'm not seeing, in which case I'm wondering what all the scripting is for. You seem to have an ajax call for... no clue what... Wait, are you sending it in those hiddens? Not seeing where that's being assigned... though that's a MASSIVE amount of JS for something so simple. the mix of SVG with canvas with static images is... strange.
Generally speaking IF this is in fact sending it server-side for the actual check, then I'm wondering what more than half of your code is even for.
Though, have you considered trapping submit on an input[image] for the coordinates instead of all that extra stuff you have? take a look at the values returned when you click on a input type="image" -- it might be far simpler to trap that than all that other... stuff you have in there.
The tables for layout, HR when there's no topic change, and presence of the CENTER tag isn't inspiring confidence either... even if it is just a test page.
Really 16k of JS and about the same in SVG for a captcha is... not something I'd put on a website. Given the quality (or lack of therin) on the images and what the scripting is doing, I'd try to see if I could get that down to 8k or less TOTAL.
Which may mean swinging an axe at the SVG.