FWIW I haven't seen any yet that gave me trouble.

Registering should (if it doesn't already) also require one, but registered users could stand not to get one (at least after N postings, for some suitable choice of N, none of which were later deleted as spam; this might even also be applied to anons with a stable IP address).

I note that all the form pages use the POST method of submission, which means you can also safely reject any posting attempts that arrive as GET www-form-url-encoded requests as being automated. That one simple criterion often weeds out 90% of the spam submissions or robo registration attempts at forum sites, and may catch bots that actually manage to defeat the captcha.

Make sure the repertoire of questions is enormous, so it's unlikely some bot maker will compile an exhaustive list of the questions and correct answers and program them into a bot. Add new ones from time to time, and retire old ones.