Unfortunately, but spammers from Russia (and not only) have long since found a way around/hack ReCaptcha v2.
In last week SPPB update we added support of hCaptcha, so you can use plugin from them than set it.
I also suggest using extension "IP2Location Country Redirection & Blocking" if your installed Firewall do not have option to lock IP (one by one, or by country).
No matter if you are using Joomla or WordPress you need extra spam projection tool(s).
There are also extra rules for .htaccess file || Check features of 8G-Firewall project.