Regarding CAPTCHA. It only annoys end users these days. Therefore, I'm not going to implement it as it's like locking the door next to an open window.
There's a couple of built-in anti-spam measures for Testimonials Premium 1.12.1. One is a honey-pot. The other is a per page load session key.
Some of my high traffic clients do report some occasional problems with spam. However, I'm working with them directly and will roll-out what works in upcoming versions of Testimonials Premium.
I've implemented a tie-in to Antispam Bee. A good tool I've found for helping with anti-spam measures. Install Antispam Bee to get the benefits.
I'm working on working with Akismet next.
If you're still having trouble with spam, I also recommend installing Bad Behavior and seeing if that helps as well as contacting support. Bad Behavior takes steps to prevent spam bots from even reaching your website which then means they can't submit spam.