CB AntiSpam can't stop humans. It's not designed to. It stops automation via captcha or block rules. Block rules have to be created manually within CB AntiSpam > Blocks as it's meant to block ip addresses, ip ranges, email addresses, and email domains. Validation rules on your username field can be used to ensure they supply valid usernames. Captcha should already be working as long as the antispam_captcha field is set to display on registration.

With that said a lot of the times those spam registrations are humans. Basically paid a couple cents an hour to create users. Once those users are created they're handed off to spam bots. There isn't really a way to stop them unless they've a pattern you can block (e.g. username structure, email domain, ip address range, etc..).