Honeypot (a module I maintain) works pretty well for small-to-medium sites in most cases. It doesn't require any extra user intervention, and catches most automated spam. It's also really fast (no expensive calculations or external API requests).
It's being modified currently for use on Drupal.org, and will be much better at also catching human spammers (it's already defeating some incredibly persistent spammers from Vietnam).
If you can't get spam blocked with Honeypot, you may want to consider Mollom or another more 'active' spam prevention service. However, I've been using Honeypot on my sites for the past year or so and have only had to move one site to Mollom due to persistent and dedicated spammers.