While if someone is deliberately making these spam form submissions, then as you said CAPTCHA won't work. They are probably using s VPN to establish a remote connection to servers located multiple geos hence you’re seeing different inferred data. Real humans don't use JS to submit forms. While this definitely is a curve ball but off the top of my head you could try the following:
-> Before processing people to the subsequent flows in your system, consider parking them in a list and deleting spam-like people directly from the system on a regular basis (ideally, daily or more frequently as you'd probably have an SLA for reaching back to people who fill Contact Sales form). You would want to update your lead management flows that trigger on person creation to not fire until you approve people from the list and deem them as valid and genuine people. You should do this at least till the time you're seeing a high influx of those non-programmatically-submitted-spam form submissions.
-> You could also automate the validation using a webhook-compatible service that checks and returns whether the person information is genuine, but you'd need to ensure that this meets data processing and privacy policies as you'd be sending PII out of Marketo (you could probably mention this in your privacy policy that is linked on your contact us form).
I'd love to see what others in the community think of this and whether they have any creative and more robust solutions for dealing with this. Also, Honeypot isn't actually that effective of a solution for catching bot submissions than the CAPTCHA is. Malicious actors could easily get to know about your honeypot requirements and then make the spam form submissions, that you'd think are valid as they all have honeypot field set as non-empty.
