I have a simple "what is two times three" randomly-generated text question and it's very successful in warding off spam. Someone could trivially automate answering it but it doesn't seem like it's worth the trouble to spammers.