Ray, can you recommend a workaround? Thanks.
This issue was resolved in a private ticket. The form action was not posting to the page where the server behavior is applied, so the server validation was not being run. The form action should post back to the page that has the server validation applied to for the captcha and security question to work correctly.