There are indeed many Lemmy instances that have captcha protection, it’s really up to the instance admins if they want to protect or not. Many of those “spam” instances do get quickly defederated by the serious ones.