You're right, you're not going to achieve complete anonymity if you're interacting with Google services in any way, but you can reduce the amount of information that they receive.

Sandboxed Google Play Services doesn't have privileged access to location information, so it can't pull your GPS location or Wifi Positioning information. It would only see a blank profile and doing this would allow for your primary profile to continue to not run Play Services.

Any malicious code which could be injected into the process would find itself in a sandbox, on a blank profile and isolated from the rest of the system.

Google would only see that you are authenticating from a profile without anything installed, from an unknown location and coming from whatever VPN endpoint that you'd like. They could possibly infer that the blank profile and your 'real' profile are different via browser fingerprinting. You can randomize a lot of fingerprinting datapoints with browser extensions, but avoiding browser fingerprinting is a whole other topic.

The 'real' privacy solution is to avoid anything that uses this version of recaptcha. However, if you have to use these services then you can still reduce the amount of information leaked via Play Services by using a blank profile to scan the QR codes.