Yes, the _marketo_comments field is part of the protection against bot form fillouts. However, like most things bot- or spam-related, the people who do such things will find a way around our current protection scheme as well. It ebbs and flows.
I would suggest either creating another field and make it hidden on your forms, or look for something common in the bogus leads being created. Then, set up a trigger campaign to delete leads that fill out that field or have that common bogus
For Marketo's part, we are already working on additional protection, it's an ongoing process!
Is there a way to pair it with a label element? As it is, ADA compliant tests are raising this as an issue for missing label.