HubSpot forms are under attack by bots–how do you protect CRM data?

We manage $50–100K/month in Google Ads, and this year we’re seeing sophisticated bots hitting HubSpot forms. They’re bypassing visual reCAPTCHA, dynamically filling form fields, and flooding our CRM with fake submissions.

Behavior-based pre-submit checks (patterns, devices, IPs, timing) helped reduce spam. For high-traffic campaigns, real-time bot filtering tools like Clickfortify were especially effective.

Has anyone else run into this? What solutions have worked for you to block advanced bot traffic without disrupting real users?