For most situations at most scales, there's a lot of simple open source captchas that should work just fine. If you're working on something that has high potential for dedicated abuse, there are some paid ones that will work well too. I can edit this post with links in a moment. But a captcha is just one line of defense, and you can take a lot of other things into account, like threat score of visitor IPs, verification methods like email, phone, etc.