Captcha / Spam filter for custom forms.

Well, that's part of making the choice to use a standard HTML form instead of using Marketo's form library with its built-in validation and dependencies. If you use an outside form, you have to use an outside validation library.  There are literally too many good ones to list here (and way more bad ones).

If all you want is a ReCAPTCHA, you don't need a separate library, though. You just need to have your developer use the straightforward Google ReCAPTCHA docs (and also set up the webhook on the Marketo server -- without this ReCAPTCHA is useless).