Bots can get past captcha if it's a good one - captcha is only a deterrent to the colorblind and near-sighted
One reason why turning on the referrer check helps as well for threads.
If you are really concerned with bots registering turn on email verification and flood checking. At ubbdev we've been the target of quite a few hack attempts, we've never had a 'bot' register, at least not since flood checking was added way back in the early .classic 6.x series.
