Instead if a CAPTCHA I use 2 extra fields to detect bot-behaviour.

One is "email_again" with CSS display set to "none" -> if this is filled in it's likely to be a bot filling every form.

The other is a timestamp. If the form is submitted within 10 seconds of being created or 30 minutes after being created, again it's likely to be a bot.

If my form thinks it's a bot, it lets the user know and offers a phone number to call if it's really a human trying to contact them.

Cheers,
Niggles