I don’t know anything about Bad Behaviour, since Akismet works pretty well for me, but that and a captcha plugin should do the job more than sufficiently.
The real answer to “what’s enough?” is whatever stops your blog choking up with spam.
Even if the occasional one gets through, its not the end of the world, as posts are incredibly easy to delete, but having said that, Akismet does a great job and has never let one through for me yet.
You’re best off just running with as litle crap in the way of commenting as possible until the situation gets SO bad that you can’t avoid making your readers jump through hoops to post. If it ever gets that bad, then add the image verification if you must.
Also, if your content expires reasonably quickly, then you might consider a plugin which disables commenting on articles once they’re X days/weeks/months old. For instance, there will be very little point in people commenting on the release of wordpress 2.3 two years from now, so there’s little point leaving blog posts like that open to spam forever.
Good luck.
