I have seen this happen recently in a clietn accout as well, it is definetly bot activity and it it never marked as spam submission by Hubspot as the criteria is super lax (email in first name or a global bounced email). Captcha is enabled on the forms but not seem to prevent anything. We are asking for the website url and I am comparing this with the email domain, in a lot of the spammer cases they are using different domains. They are using some lists of valid domains that are not in use. Also some of the emails used are not just made up, emails show as delivered but they are never opened or clicked so they might have some lists of abandoned emails.
A lot of these submissions are coming from Adwords campaigns so I suspect it;s a sophistcated ad fraud scheme, whould be great to be able to squash this.