I use a mix of honeypot fields, Cloudflare turnstile and straight up blocking certain domains from signing up.