For anyone who wants to squash all form spam, if you enable the "Validate Phone" setting if you're collecting someone's phone number, it gets rid of all form spam. You'll only get real people after.

There are downsides to that though depending on what you're doing, that's the best current work around I've found for this issue

I had to stop using the GHL forms because we got swamped with form spam submissions. The GHL captcha option does nothing to stop form spam submissions.

The bots use real contact info thats scraped from the web to submit forms. The chat widget seems to have better anti spam protections that aren't present in the embedded web forms. Can the same code be used in the web forms somehow?

Another alternative could be having Cloudflare turnstile as an integration option for the forms.