I'd love to see a captcha feature, just because I've experienced a lot of spam from PPC campaigns.
That said, I've previously set up my own, and it works if the spammer is a bot.
I created a field called CAPTCHA whose label is something like "6+3=". Then in the flow actions, I only sync the lead to SFDC if that field is equal to 9. Otherwise, the lead just hangs there or, as mentioned above, can be automatically deleted. I never deleted them automatically just in case, but NONE of the leads who completed that field incorrectly were real.
Hope this helps.