The CAPTCHA module and its reCAPTCHA submodule are the most popular way to block spam bots from forms. Install both, configure reCAPTCHA with keys from Google, and apply it to comment forms, contact forms, and user registration.
The Honeypot module is a good alternative or complement. It adds invisible fields that real users do not see but bots fill in, flagging those submissions as spam. It is less intrusive than CAPTCHA for legitimate users.
For commenting, enable moderation so new comments go to a queue for review before publishing. The Antibot module blocks form submissions that happen too quickly to be human. Combining multiple techniques is more effective than relying on any single approach. Spam evolves constantly, so stay aware of what is working and adjust your strategy as needed. Most sites need at least two of these tools.