The easiest thing to do is just require people to enter some simple piece of information, like their state, in one of the form fields. Then name the field something random (and give it a max length of something other than 2...) so the bots can't automatically identify what type of field it is. 99% of the bots should be stymied.