I think there may be a misunderstanding on how spam prevention works unfortunately. The reality is, in order to prevet spam, they need to first of all be known to be spam. As bots get more sophisticated, they get closer and closer to looking like human registrations. So you run a fine line between preventing spam, and preventing actual registrations. And when you do pick up on IPs, email addresses etc, it takes time for them to be known as being spam.
What I would say here, is in almost all circumstances when we have looked at customer sites, the following tend not to all be in place
Spam service set to its defaults
Multiple question & answers set up, that are not machine solvable (putting something like "What is 2+2?" will simply be solved by a bot. Having only 1 set up means once its solved, its solved)
Not yet using hCaptcha, which was added to our software to try and combat some of the more advanced spam that was turning up
Not adjusting hCaptcha settings to a level at which is reducing spam to a suitable level
I would advise anyone who is having problems, check the settings above. This said, there is no silver bullet for spam that will work every time. There will be times where items such as these make their way through.