One surprisingly useful solution to foil most spam-bots is to use a honeypot. Put an extra entry field into your comment forms, and then hide it with css. Normal users won’t fill it in because they won’t ever even see it. Based on that, you can safely assume that anytime an entry is made with that field filled, that it’s a bot and you can just discard/mark it as spam.
