I've found most spam comes from bots operating from certain countries. Filtering traffic by IP address will stop a lot of spammy traffic. I've used a combination of GeoIP and IP address catagorization to limit the impact of bots on my side-projects.

Bot Protection: https://github.com/growlfm/ipcat

GeoIP Evaluation: https://dev.maxmind.com/geoip/geolite2-free-geolocation-data...

You can dig deeper using dedicated services for URL and image inspection.

Image Evaluation: https://cloud.google.com/vision/docs/detecting-safe-search

URL Evaluation: https://cloud.google.com/web-risk/docs/overview