A couple of ways I've handled the spam situation in the past:

1. Base64-encode your form field names and decode them server-side prior to processing, or...

2. Create one-time use field names using md5 hashes of random numbers, map them to their true fields and store them in a session. Then process against those on the server side post-submit and clear the slate. (I used this method more often than not.)

3. Control the visibility of the honeypot field with CSS rather than "type=hidden".

Using #1 OR #2 in addition to #3 I've never had to use CAPTCHA nor human tests. A few paid spammers have come around from time to time, but since automated software isn't sophisticated enough to pick apart which field's which it either doesn't even try or it throws whatever it can at the fields, getting locked up in server-side validation.