Well, I believe your options are pretty limited here. What are the reasons behind not being able to implement the CAPTCHA on your forms, is it due to privacy concerns?
Even with the CAPTCHA in place, there's a possibility of bot submissions creeping into the Marketo database. Without it in the first place, you could potentially rely on pattern matching, e.g., time/IP-based verification, though they're not gonna be 100% reliable. If you're receiving too many form submissions from a particular IP address/IP range, then you can investigate those form fills. You can also use behavior-based tracking to assess user interactions before form submissions. For example, if a user hasn't visited any other pages on your website or spent very little time on the site before submitting the form, it might be suspicious. Also, just for your reference, honeypot fields don't work as bots could easily identify the honeypot requirements on a form, and could skip filling in the value for that field while submitting the form.