All our themes which offer users registration have implemented with registration form also captcha protection to limit spam registrations as much as possible.
Once the users registration is allowed in your WordPress general settings, wordpress enable own built-in way for users registration via file
wp-register.php. This form isn’t secured in any way by default and most of spam registrations comes right from this form. You can find this registration form on your website if you open url like:
From our side we can recommend only to look for plugin in WordPress repository which may block registrations via this form. Form is accessible for public and well known by bots to register on websites built on WordPress.