How can I use recaptcha to protect against Javascript based attacks

I've built a website which adds recaptcha v3 according to the docs. The site contains a wizard which the user steps through in order to book a holiday. At each step I execute the following code:

function exec(action) {
    grecaptcha.execute(<myToken>, {action: <theNameOfTheWizardStep>}).then(function(token) {
        // verify with the backend
        let config = {method: 'POST', headers: {'Content-Type': 'application/json'},
                      body: JSON.stringify({recaptchaToken: token, ...}) };
        fetch('/book?action=' + action, config).then(r=>r.json()).then(result => {
            console.log(action + " result: " + JSON.stringify(result));
        });
    });
}

My server verifies the token like this (Python):

recaptcha_verify_url = 'https://www.google.com/recaptcha/api/siteverify'
resp = requests.post(recaptcha_verify_url + '?'
                     + 'secret=<mySecret>'
                     + '&response=' + recaptcha_token
                     + '&remoteip=' + request.remote_addr)
verification = resp.json()
print("verified: {}".format(verification))

recaptcha_token is sent to my backend using the Javascript above, i.e. provided by the call to grecaptcha.execute

The print statement logs entries like this:

verified: {u'action': u'book_step2', u'score': 0.9, u'hostname': u'mydomain.com', u'challenge_ts': u'2020-04-05T22:52:45Z', u'success': True}

That works good, and during each step I get a score of 0.9.

I need to protect my server against robotic attacks like the following, and I assumed that the score would drop if a script was written which bombards the server with robotic requests, but it doesn't. Have I programmed something wrong, or is this kind of attack not what recaptcha is designed to protect against?

function thisIsAnInjectedHackerScript() {
    for(var i = 0; i < 50; i++) {
        exec('book_step2')
        .then(result => {
            console.log("executed " + i);
        });
    }
}