Stop spam-bots with Honeypot
A honeypot is a very effective technique to eradicate a spambot problem. It's a very simple concept where a hidden input field is appended to a form. A human won't see this invisible form field, but a bot parsing HTML will. If the form is submitted with a value for the field then it's assumed the form wasn't submitted by a human and therefore ignored.
Install the Honeypot module:
composer require drupal/honeypot
Within the module's configuration page, check "Protect all forms with Honeypot". If you need to protect specific forms in your code, in your form definition function, or within a hook_form_alter(), call:
honeypot_add_form_protection($form, $form_state, ['honeypot']);
You will see a significant reduction of spambot activity.