What are some of the best ways to prevent form / api / action abuse from malicious actors? I would preferably want something that does not require any external dependencies such as Cloudflare, Google, API keys, etc.

Are there any self-hostable CAPTCHA solutions or other effective ways of preventing spam, besides rate-limiting and request throttling?