I discovered that the encryption method for the challenge mixes in the IP address of the server. That's fine most of the time, but if you are on some sort of load balanced server farm the box that provides the challenge may be different than the one that parses the submission, and people who are trying to post on your blog get an incorrect error message.
The fix is trivial -- just comment out line 160 of math-comment-spam-protection.classes.php. It doesn't do anything anyway.
This:
$inputstring .= getenv('SERVER_ADDR');
becomes:
// $inputstring .= getenv('SERVER_ADDR');