Spam protection should be quiet for genuine visitors and useful for the business. A giant puzzle is not always the best answer, especially on a form where a potential customer is already deciding whether to make contact.
Layer the protection
Use server-side validation, sensible rate limits, a hidden honeypot, good input handling, and monitoring. Keep required fields focused. If a challenge is necessary, make it accessible and explain what is happening.
Protect the workflow
Store submissions safely, separate spam for review, and make sure a false positive does not hide a genuine enquiry. Test the form on mobile and with assistive technology after adding protection.
Form reliability belongs in a broader WordPress care plan.