3
I'm using
XF-Guestbook and had a lot of spam too suddenly.
In version 2.40 there is an option to have a verification code that has to be entered by people who want to sign the guestbook before they can submit their message.
Only problem is that this verification code check doesn't work if you have Protector installed too.
I renamed the file sign.php and also in a couple of other php-files.
Since I've renamd the sign.php file my guestbook is spam free.
Renaming sign.php is probably fooling the spam-bot.
The module
Xoops-Stats has an option to block bots.
Maybe you can do something similar for the comments.