I know they are not real users because I get 50 to 100 in one go. Its just automated spam users. They cant spam because I lock down the user access to the forums to very specific users but it still fills up my user-list. This is after Akismet/Jetpack has filtered out hundreds already.
If Captcha worked or if I had a “challenge question” I guarantee these would not get passed. So I wondered if I can set them up for user registration somehow?
Edit: Actually I activated two-factor authentication via Jetpack and that seems to have stopped the fake registrations. Though its a bit heavy handed.