What is your experience with AI and SPAM bots becoming more agressive, is the interal captcha still sufficient?
Internal Captcha + Honeypot + Timer seams to work pretty well at catching a substantial amount of bots.
However if a bot is tailored to your site there's little chance any captcha will stop it and you'd need something like Cloudflare bot protection to try and stop them at the domain level. Most sites however are fine with traditional captchas. If you don't want them to have to fill out a captcha code consider using one of the cloud captcha modes (I recommend Cloudflare Turnstile).