A minimum point level should help. I doubt a spam bot will bother to solve a challenge
If that isn't enough, I've been pretty happy with
Akismet in the past. It does a pretty good job at identifying spam. It is mostly associated with blogs but the API itself seems pretty indifferent to that fact, and the API is key is very reasonably priced.