Content Security Policy

If your site sends a Content-Security-Policy header, the browser blocks anything you haven't allowed. Add Waitlark and Cloudflare Turnstile (the bot check) to it.

With the embed

script-src  https://api.waitlark.com https://challenges.cloudflare.com
connect-src https://api.waitlark.com
frame-src   https://challenges.cloudflare.com

With your own HTML form

script-src  https://challenges.cloudflare.com
form-action https://api.waitlark.com
frame-src   https://challenges.cloudflare.com

Do you send the form with fetch instead (see Sign people up with the JSON API)? Then add connect-src https://api.waitlark.com as well.

How to tell it's the policy

Open the browser console on the page with the form. A blocked address shows up as "Refused to load…" or "Refused to connect…" with the directive that blocked it.