When I ran a phpBB forum that spammers would join to get some of my PageRank 2 juice, putting up a special question on the registration form (by modifying the php code), was much more effective than phpBB3's captcha function with maximum difficulty applied.
Spamming software doesn't have support for capctha questions, only captcha images.
I wrote a plugin for wordpress years ago that simply asked you to copy a number into a box. If you had JavaScript, it would even do it for you and hide it so most users never even knew it was there. It filtered out nearly every single piece of spam. This would have been mid-2000s though, might be different now.
At least that's what I initially thought. But after some more digging it seems that x and y are hard-coded to be 2 and 3, respectively.
I opened the registration page in 4 different browsers with different IP addresses (my own, my VPS, and a couple borrowed from Tor) and in all cases the "security" question was "What is 2 + 3?"
Unbelievable.
Believable.
Extremely believable.