Only thing I have enabled is Akismet. Think I've managed to dodge a lot of spam by not showing the comment forms to known bots; otherwise, I might have looked into additional things.

Probably best Anti-Spam thing I've come across in WordPress is Anti-spam — WordPress Plugins which catches 99% of the stuff before Akismet even sees it and there is nothing for a user to do.

Not that WP is topic here but there I prefer https://wordpress.org/plugins/antispam-bee/ because it is privacy friendly. Akismet at least over here actually cannot be used savely.