I still sometimes get spam comments on sites where I do not have the comments activated. The only way that they can do that is with automated bots that inject the spam comments directly into WordPress.
Just ignore everything that ends up in the spam bucket. There is no reason to go through it and no reason to be concerned about it. It is automatically deleted after a few weeks.
You are correct about the Internet becoming a spam cesspool, but that should be stated in past tense, not present tense. It has been a cesspool for a long time. People will do what they are encouraged to do and the Internet makes a lot of this behavior easy to automate.
It is nature to blogging community that there are always spammer everywhere and I would suggest to make a new captcha that uses problem solving feature image (I've seen it in other blogs and forums) and must have atleast one moderator to monitor your site.
There's the scrapebox tool which can auto post comments to thousands of blogs. The tool is used with some captcha solving services, so it can pass any of your math trigger :)
Only a damn fool would use some tool to submit to blogs!
Geesh...you are like 15 years behind the curve!