Google ReCAPTCHA provides a free service to detect spam from malicious bots for up to a million requests per month. Additional requests can be purchased in blocks at an affordable price.
To get started, you need to sign up for an API key pair for your site. You need to obtain the following keys and enter into your Configuration > Risk settings under the Spam section.
The spam score will range from 0 (likely bot) to 100 (likely human). A recommended approval score of 50 is a good start to filter out most bots.