How are spam bots making submissions to civiCRM?
If you have a CiviCRM profile assigned to "Drupal User Registration" (as "Name and Address" is by default, I believe), then spam bots that apply for an account on Drupal will also be inserting fields from that profile into their associated CiviCRM contacts.

If you aren't using the account functionality you can turn it off in Drupal (admin/config/people/accounts) by allowing Admin only account creation. Otherwise you can look into Drupal-specific spam blocking modules such as Honeypot.

There are also some CiviCRM-specific fraud prevention suggestions that may be of interest to you.