You should of searched the forum for many answers to this already posted.
There are a lot of options and solutions with this… for me, I use the plugin “buddypress humanity” on one of my sites, and a different / similar plugin “good question” on another site.
Change the default questions and answers… this stops most of the auto-bot spammers.. a few manual people may get through, but it cut does spam signups on my site by 99%.
One of my sites I disable “group creation” for all users, as that seems to be a target for many of them.
I also use another plugin with my bp+wp / multi-site … which sets “blog defaults” so that any user who creates a new blog has settings automatically enabled that “block this site from search engine indexing” – if someone signs up and creates a site and adds original content, I will go in an manually change that setting.. most people who “create a site (blog on multi-site) – don’t use them, or are spammers – so I don’t need them sucking away page rank juice or clogging up the activity stream with BS.
random thoughts from another BP user…
I’ve seen a few places mention this plugin:
https://wordpress.org/plugins/wangguard/
(not actually used any myself as site isn’t live yet)