To be honest for casual bots the best defense is a nonstandard feature in the sign up. Just something weird that trips the bot up. A progam customized to your site could easily defeat it but casual spider spam bots that crawl the web wouldn’t know what to do with a radio box set with the options 1,2,3 that asks you to pick 3 and defaults to 1.
I’ve always wondered how come 4chan isn’t spammed to death. Other then anontalk, and dial soap you never see spam posts. It has no captchas, not only are sign ups not required it’s impossible to sign up.
If I was a spammer I’d ream them a new one with spam. They can’t filter by IP, bot nets in the thousands are do able if you have basic skills and a little time so it’d be possible to sam from thousands of IPs.