The Q&A's works wonders, you should probably add captcha for new members only. Like, they have to have 20 posts + 5 days registered to be moved to the next usergroup. The hidden field is smart, you can also put a time stamps on your hidden fields and check how long the user took to register, less then 5 secs = bot.

CloudFlare is free...and it is on steroids lol, but the real benefit is the security features. It stops spammers and bots at the dns level. With CF you also don't have to leave your host. The only downside to this is that you can no longer hide your ip with dnsmadeeasy, since they have a policy to give your IP on request.

You can also limit the amount of signups per IP to help against trolls. Anyways, let us know what you decide!