I never thought I'd be REQUIRING javascript on a form, but here we are.
The comment spammers are bad and prevalent, but it seems most are just bots without javascript.
Ergo, the drupal module antibot.
Combined with Jeff Geerling's awesome Honeypot, spam control is working so far on the newest rebuild. This is not a jinx, this is not a jinx...