Some of our clients' sites get hit by bots occasionally - usually for a sustained burst and then nothing. There are many bots out there simply crawling and looking for forms to submit - especially ones with large text fields that they can populate with spam adverts or links to sites. We find that usually simple validation on values on a few fields, such as valid email and phone numbers is enough to prevent them however as most bots are not very sophisticated. There are various other approaches I've seen such as only enabling the submit button if specific Javascript is run by the browser, but this approach often runs foul of accessibility requirements on our sites so we we avoid this.

Admittedly though, while we have offered Captcha protection for a while now to our clients, none have yet gone for it.. So I'd agree that it's generally unnecessary.