I think the kind of defense you need to use depends on what kind of website you have.

Based on my experience if you have a small/medium website you won't find bots that execute javascript, understand a web page or use human spammers.

Those are reserved for the big ones, for all the others is mostly general-purpose bots that try every form they can find on the internet. Where speed is most important than accuracy spammer won't use the "Heavy" bots.