A IP of de.wiki was telling, that he get a CAPTCHA for a edit, where only a comma is changed.
In my opinion is this a problem with protocol-relative URLs.
The page includes a fullurl to commons. Before the edit the database contains a http link to commons, after the reparse due to the edit the link to commons is changed to a protocol-relative URL and ConfirmEdit is seeing a different and trigger the CAPTCHA -> bad in this case.
We can fix this by editing all templates with fullurl to trigger a reparse with the Job Queue, but that sounds like many load for the server and also fixed that problem only on de.wiki.