I am sorry to say so, but the code is the work of a script kiddie.

This captcha is easy to be solved by bots, I agree with Aveatrex.

There are solutions like Google reCaptcha out there, with many, many algorithms. They even watch out for malicious activity, badly-known IP addresses and so on. They have sort of scoring behind it and make the captcha as difficult as needed for the specific client (or block it at all).

The only need for another captcha solution is a self-hosted approach, without sending clients data to Google or some other service providers. To my knowledge, there is no nice solution for PHP as library. So, your idea is nice, but the current state is absolutely useless.