I have multiple spam bots that try a couple hundred times a day to access my website and post comments. I have reCaptcha installed and somehow they are able to register, and sometimes actually post spam. I also have the honeypot module installed. What is the best way to stop this?
The alternative I can suggest is the Mollom module, created from Dries Buytaert, and which uses a service provided by Mollom BVBA, an Acquia company, both co-founded by Dries Buytaert.
Mollom may block a post outright if it is from a known spammer. If Mollom is unsure how to classify a post, it may require the completion of a CAPTCHA to accept the post. Posts that do not match a "spammy" text pattern and do not originate from known spammers are accepted without the need to complete a CAPTCHA. Essentially, Mollom acts as a proactive content moderator that is on the job 24 hours a day, 7 days a week.
If you want to read a negative opinion, you can see What's wrong with Mollom?
Before mentioning reactive solutions, I feel obliged to throw out there that locking things down as much as possible is one key. If it's not a community site, you can hold comments for moderation and prohibit new registrations without admin approval. Then anything that gets through is because you've fallen behind on some security update.
As for the anti-spam otpions in Drupal...
In brief, I like to see CAPTCHA solutions as a last-ditch effort. Automated CAPTCHA solvers are cheap and CAPTCHA solving services that hire employees to solve captchas will solve them in an avg of 20 secs and are under $10/10,000. Meanwhile, the captchas have gotten so damn hard to read, that I often take six tries. It's a losing battle - in another couple of years, I am convinced that automated captcha solvers will be superior to humans at this task and they will serve only to annoy real visitors.
Drupal has so many modules that let you stop spammers by requiring "proof of work", by comparing to a blacklist, by analyzing behavior or whatever that I rarely use captcha with Drupal.
I'm new at Stack Exchange and I don't know if it's allowed to link to our own blogs, but I did a pretty long, one might say overly verbose (but hey, it's for my reference, nobody is forcing you to read it), blog post on some of your options and my subjective, ill-considered and quite possibly wrong opinions on them. Here's my list:
I should add that since I made up that list, I've also started using Cloudflare which integrates nicely with Drupal with the optional Cloudflare module. This stops a lot of attacks before they even get to your sever. For those that don't know, it's a reverse proxy service and so before they even forward the request onto your server, if the IP is in their list of known spammers, they block it there. I have been using Cloudflare for a couple of Drupal sites and at least one Wordpress site and am very pleased. The one thing to be aware of is that if it's an e-commerce site, using Cloudflare (or any similar reverse proxy on a separate server) will require you to buy an additional SSL/TLS certificate. Other than that, it's the simplest plug and play thing and blocks a lot of spambots (now I have to remember to update my spam module page to include that!)