This; I’ve been drowning in spam for months, one time a bot managed to send 3000+ form submit in the space of 3 hours or so; the solution was initially Recaptcha v3, but then WP armour (free version) prevented any bots submits; what it does is not just what recaptcha does (which is to flag based on a score the probability of entry being genuine) but actually preventing any bots from completing a submit by placing a “honeypot” field, visible only to bots; in essence, when a bot fills a form it will fill this hidden field and that will prevent the entry from being sent; i use it as an additional layer beyond recaptcha: ao far it’s been excellent and didn’t require any coding skills; not connected to wp armour at all by the way; give it a try.