Bots crawl landing pages and stuff forms. Some to test stolen cards on any form they find, some to scrape, some for reasons known only to botnets. Display campaigns and lead-form extensions attract more of it than search.
Defenses that work without punishing real leads: a honeypot field (invisible to humans, bots fill it), server-side validation, reCAPTCHA v3 (invisible scoring. Skip the traffic-light puzzles), and blocking known bot geographies if you only serve locally.
Also protect your metrics: filter obvious spam before it counts as a conversion, or your 'cost per lead' becomes fiction and smart bidding optimizes toward whatever the bots like.