If memory serves, you're behind Cloudflare, yes? Go and ban all .ru .cn .ua etc. Yea, it won't necessarily stop spoofing, but it will help. Things like this come in "storms" as they're called. I was getting all kinds of bullshit on my web form, when I blocked .ru - it came to a screeching halt immediately. Another one to block is amazonaws - there's all kinds of bullshit bots being run from there. It took me a bit to figure out how to turn that crap off (via Cloudflare), but I got it done a couple of weeks ago (the .ru etc block has been in place for about 3 years now). I was getting HAMMERED by amazonaws bots!
Yes, this forum is behind Cloudflare and I have banned all those that you mentioned. Doesn't seem to stop. Some of these bots are pretty sophisticated it would seem. I'm going to check on the XenForo forum and see what others are doing. My guess is someone has a add-on for this.
I think the bots can actually pass many CAPTCHA tests nowadays, the pricks writing the things are pretty clever, albeit colossal assholes for doing it in the first place.
You might want to check out the support forums for Xenforo, there might be some help there or some plugin for the site that you could install to keep them out.
In the interim, you could take the drastic measure of closing new registrations....not the best solution but it might help until you find a more permanent one.
You're right, CAPTCHA is largely ineffective these days.
I'm going to ask around the XenForo forum and see what others suggest.
What gets me is the crap these bots post. Witchcraft spells and abortion pills? Who the hell is going to click on any of this crap? At least try and make your spam look legit...sheesh.