Both are okay as far as legality goes (they're both freely available and freely usable). The only question is whether either would cause issues with high resource usage. It's unlikely that KeyCAPTCHA would pose any problems. GeSHI shouldn't pose any problems either; I haven't tested it, but I haven't been able to find any performance complaints about it online either. (It is possible to write a syntax highlighter that will take up an enormous amount of memory while parsing and lexing, but I'd expect to see some complaints online if GeSHI did that.)