I've had a lot of success by including a field called email in my form, hiding it with css so humans cannot see it, and whenever a submission/login request/post

I've had a lot of success by including a field called email in my form, hiding it with css so humans cannot see it, and whenever a submission/login request/post is received, I merely check to see if the email field has been set. If so, I know it wasn't a human that submitted the post - they could not see it - whilst automated spam tools seemingly cannot resist entering something in that field. I emailed suspect postings to myself with IP address info to add them to an IP block-list later, but showed them a fake "success" page or a "your post has been selected for moderation" page. The latter turned out to be more effective as it resulted in fewer repeated attempts. I removed the annoying reCaptcha code altogether as a test, and never had to reinstate it. Real users hated the reCaptcha thing anyhow.