I switched to Q&A CAPTCHA, with questions made my me, spam user registration has actually completely stopped. Seems like spam bots are able to easily get around the default CAPTCHA
I just setup my forum and I am already getting dozen for spam account requests. I have reCAPTCHA enabled for new uses and have also installed cloudflare WAF and security. Is there something else I can do?