Drupal 7 comments spam with Captcha installed
"to prevent the attacks" - not much can be done here. If an attempt to access node/add page ends with access denied page, its ok. You cant prevent users from entering urls in their browsers.

As for spam in comments, try some different modules for Captcha (Google reCaptcha with noCaptcha for example).
For different aproach, Honeypot can help limiting "robots" behavior.