how to stop spammers from registering and spam posting?

[saf-t scissors]

Does anybody else require custom profile fields to be completed on registration?

We require email confirmation and stock vB captcha, plus several custom profile fields. Within the last couple of months, we've had increasing amounts of spam traffic, most of it from actual humans, though. I don't get the impression that it's coming from bots, simply because we started requiring moderator approval on new accounts, and the spammers subsequently got better at completing their profiles on registration.

Of course, as soon as I say this, we're going to turn up with a huge bot problem. But I'm curious what role the custom profile fields play in discouraging lazy bot programmers.