Problems with turnstile on forms

Turnstill suddenly stopped working on two of my Grav sites. The widget displays, but get the message "Human verification has identified this form submission is problematic" after submitting.
I have changed the keys on the form plugin after refreshing on turnstile and have checked the whole form config, but I cannot see my problem. The only site that does not have the problem is still on the older version 2.0.23 of Grav while the two that do not work are at 2.0.26. All use version 9.1.24 of the form plugin. I am not saying that the newer version of Grav has caused this, just observing the difference.
I have turned on the basic-captcha for now, but I don't want to keep it that way.

Hi Marcel, thanks for including the version comparison. That message is a generic CAPTCHA verification failure; it doesn’t necessarily mean Cloudflare has classified your submission as suspicious. The widget can display successfully while the server-side verification fails.

Could you reproduce it once on an affected site, then check logs/grav.log for entries containing Turnstile validation failed, Turnstile validation error, or Form Captcha (turnstile)? Form 9.1.24 already logs the underlying error, so there’s no need to enable the frontend debugger. Please share the relevant error lines, with any secrets or personal information removed.

The error should narrow this down:

• invalid-input-secret points to the secret key used by the server.
• invalid-input-response means the submitted token is invalid.
• timeout-or-duplicate means the token expired or has already been verified. Turnstile tokens last five minutes and can only be used once.
• An SSL, DNS, or connection error means the server couldn’t complete its request to Cloudflare.

Please also share the form’s CAPTCHA field and process: configuration, with keys removed, and whether it uses AJAX submission. In particular, check that process: doesn’t contain both turnstile: true and captcha: true, since both invoke CAPTCHA validation and could verify the same token twice.

The Grav version difference is a useful clue, but the log should tell us which part is failing before we attribute it to the update.