Recently I launched a new Drupal 8 website and was surprised by a spam amount we got via website's contact form (built with Webform module).
As the website was new, I was manually blocking each spammers IP, but the amount got larger and larger, to avoid that, I decided to install Captcha module, just like in the case with Drupal 7, see: Adding CAPTCHA to Drupal 7 Webform
A CAPTCHA is a challenge-response test most often placed within web forms to determine whether the user is human. The purpose of CAPTCHA is to block form submissions by spambots, which are automated scripts that post spam content everywhere they can. The CAPTCHA module provides this feature to virtually any user-facing web form on a Drupal site.
I will assume, you have already configured your webform, now let's add captcha to it, and keep those spammers away
Go to admin/config/people/captcha click on the tab Form settings, as we are using Webform module here, enable node_webform_form
Drupal 8 configuring captcha module
Once, enabled, click edit and in the blank text box under "Form ID" enter the form_id (not the node id) of the webform and save the configuration.
To quickly find the form_id of the webform, take the node id and insert it to "webform_submission_contact_node_XXX_add_form", for example if the node id is 6 your webform form_id will be "webform_submission_contact_node_6_add_form". You can also use firebug to inspect the form_id field.
Go to the webform page (as Anonymous user) and you should be able to see the captcha there.
Captcha enabled on Drupal 8 webform