Custom form sending data to external CRM – SPAM not being blocked

I have a custom form on my website sending data to an external CRM and, although Cleantalk reports that it has blocked SPAM for this form, the data is still being submitted to the CRM. I have ‘Protect External Forms’ enabled and ‘Protect internal forms’ enabled, the SPAM data is still being sent to the CRM. Please advise.