In the time it took me to get the reCAPTCHA module installed on the registration page last night, there were 8 bots that registered users. It's now been about 12 hours, and there are no new successful registrations. I did check to make sure that it still works, and it does, so all is well.
I just needed to go to the CAPTCHA admin page, go to the "CAPTCHA points" tab, and enable the user_register_form, then edit it to do a reCAPTCHA. Well, I needed to register the site with google to get keys.
I set up a Drupal 7 website a couple years ago for my work, so Drupal 8 doesn't seem as foreign to me as it otherwise might, having last used version 5. Even so, there are a lot of changes since version 7, some of them good, others just confusing.
Setting up a new site requires making a lot of decisions.