We are unable to give specific information on how the spam service works internally unfortunately
Spam detection is simply not an exact science unfortunately. There will be times where these people who are signing up are actually real people creating the accounts by hand. In that case, they will indeed get through. And at times you will get an influx of those as you seem to be getting currently
There is no way in which to do this at the present time. Its usually items which are simply answered by google they will get through with no problem at all if they are bots. For example on yours
If google is getting the answer right like that, then so will the bot.
Because often the reason people will contact on a contact form is to tell you they are having issues registering. If that issue is they cannot register due to the spam protection you have in place, you leave them in limbo
Looking at your spam defense setup there, the first thing that is glaring here is that you have changed the default setup on the spam defence tab
As you can see there, you are actually allowing users to register as normal whn they are likely to be spam. The default for 3/4 would usually be manual review on a default setup.
Have you taken a look at your settings on hcaptcha, as you can set higher levels on this if you are still seeing issues. However do bare in mind what I mention above. These may be actual people doing the spamming. If they are, then of course they will get through these.