and now we play the waiting game... to see if all bots will actually check off the box
Nice, but wouldn't it be more affective if you had it checked by default and require users to uncheck it (i.e. prevent automated sign-ups)?
I now have another field now which is just a textbox that has to be cleared. The error message it spits otherwise isn't helpful to a human, though. It seems to be working a bit better, but of course human spam is a bit harder to counter.