Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.
The challenge can’t be disabled or exempted for particular routes. This article says the check covers every URL on your site and is mandatory on free hosting:
The same article says that same-domain AJAX/fetch calls made from a real browser work normally, so your widget requests shouldn’t normally hit the challenge. Something about those requests must differ from a normal in-page call.
Can you check, in your browser’s developer tools (Network tab), whether the failing requests go to exactly the same hostname as the page (djprshsportal.wuaze.com, with no www. or other variation) and carry the __test cookie in their request headers? Also, are these requests made by the page’s JavaScript in the browser, or by something else, such as a service worker, a separate app or a server-side script? The article says only requests from a browser that runs the page’s JavaScript and keeps its cookies get through.