Is there any way to keep legitimate contacts in the registrar without getting a ton of spam?

There is a ruling that prevents hiding the .us domain registration and contact information or using anonymizing proxy [1]

Your information must be public. Maybe you can try national do not call registry [2] and see if it helps in this particular case.

[1] https://www.washingtonpost.com/wp-dyn/articles/A7251-2005Mar...

[2] https://www.donotcall.gov