Is there any way you can change your plugin to not use PHPSESSIONS?
I see you've commented out a lot of
session_start calls, but it still sets a session cookie so Varnish doesn't cache.
I think this is just in your captcha and turning it off would work, but it's someone else's site and I can't be 100% sure. It'd be great if you didn't use 'em though :D