My phpBB forums was swamped with spam for example, and when I installed a wordpress blog no human other than me ever read, I got plenty of spam too. Yes, I have a low traffic site, a few dozen visitors a day, but still - the difference between using off-the-shelf and my own is HUGE. If I had a higher traffic sites, bots would make more effort, so I would make the captcha more complex. So far I didn't need to, which is kind of the point. Bots go for low-hanging fruit.

I do the same thing as you on my personal blog. About once a year a human spends a couple days analyzing my site, doing hundreds of post test runs, and defeating my custom spam blocker. My blocker notifies me about this and by the time he deploys it in the spam helper software he sells, I have already blocked the new attack. Custom solutions are of course not available to those who can't program, but for those who can it's a great solution that allows for anonymous comments without tracking or violating the person's privacy.

Also, the highest quality comments from real people and least spam I have seen anywhere on the internet are on Hacker News and on Reddit. Guess what both sites have in common? Anonymous hassle-free posting. The Hacker News sign up page contains the least amount of information needed to sign up possible - alias and password - and nothing more. It rivals the Google home page in its simplicity and functionality. Meanwhile discussion boards with elaborate "real names", "track you" and "exotic captcha" solutions are riddled with spam and heavy on both inane and trollish comments, showing that spammers motivated by profit are not deterred by complex sign ins, only legitimate users are.