Issue fixed by pull request #9. More details in the PR itself, but the general gist is that maxclassrepeat=1 will not have the expected effect of disallowing any password with more than 1 of the same character class in a row. Rather, the check will be disabled entirely. Bug is in pam_cracklib.c.
Should have opened an issue in the fist place, but opening one now to try to get the PR reviewed and in.