Hi @PHA_iPadag,
This is a tricky one and will always be a cat-and-mouse game.
As you already mentioned, you can enable Google CAPTCHA on your forms: Prevent and filter spam in form submissions
You can manually block email providers if you can identify a pattern: https://knowledge.hubspot.com/forms/prevent-spam-form-submissions#block-specific-email-domains-or-fr…
You could, as you mentioned, include a hidden field in your form, assuming that especially bots would accidentally fill this – and then filter out contacts where the hidden field is filled.
If there is any pattern in how contacts fill certain fields (e.g. within the message field, the email domain, first and last name), you can build an active contact list that finds these contacts and regularly delete contacts form the list. You would refine the criteria over time. Create segments
Lastly, on a hosting-level, you could check if you have settings to block bot traffic, see for example here: https://www.cloudflare.com/learning/bots/what-is-bot-traffic/
Hope this helps!