Everything else is blocked with pihole/uMatrix/pf. Been this way for about six months now. Occasionally I still youtube-dl from a server and scp the file locally.
At first I got passive-aggressive about it. I would purposely fail the ReCaptcha and then contact support to tell them it wasn't working. They'd always provide a workaround. But then I realized it was easier just to stop giving them my business. For me personally, so far it really hasn't been any kind of big inconvenience.
https://hcaptcha.com/ is a drop-in replacement for reCAPTCHA.
It's privacy focused (supports privacy pass), and is fair: webmasters get a cut for each captcha that is solved correctly (they can choose to directly donate it to a charity of their choice), hCaptcha get a cut for running the service and a customer will get their images/data labeled.
Do you have the scale that human moderators are infeasible? (Not do you "wish to have". YAGNI suggests add it when you have that scale, not before.)
Do you need that form to be publicly accessible?
Are you requiring multi-factor authentication already? Can you or should you?
Can you use a spam filter? (Are you sure your process isn't already going through half a dozen email spam filters anyway?)
Do the simple tricks not work for your use case? (CSRF tokens, "honeypot fields", form name/ID obfuscation, dumb simple weird rotating required fields like "2 + 2 =?")
There was daily contact form spam coming from tor exit nodes. Only flaw is that it always sends the message within 7 seconds. That is faster than a human could get to the form and type a meaningful message.
So I was able to avoid blocking tor exit nodes by adding this timeout. This has solved the issue, for now.
Requiring JS execution by only accepting JSON stopped the lazier bots.