I've had to enable Captcha on some of my client's sites:
Admin > Configuration > Settings > General ... > Security tab >> CAPTCHA enabled:
Admin > Configuration > Settings > General ... > Security tab >> CAPTCHA enabled:
I have recapcha enabled and I am still getting fake registrations.
Regarding the forum, I had to simply turn it off. What use is a forum is 99% of the post are bogus fake meaningless post with many links to other sites in them? Nothing to do with the topics.
It seems to be a full time job deleting fake registrations! My Goodness!