This is where spam posts go to die.
Spam bot are not that intelligent, they just dump their spam into any form that will take it. So I added a spam category to my form and made it default. When a spam bot posts, it doesn’t change the category and now the post is flagged spam and I can just delete everything in the spam category!
I rather just not have the spam post at all, however the spam is evading the CAPTCHA and my form processor is very basic. So for now this is it (also allows me to experiment on other ways to block spam.