Virtual private networks can easily change a users IP address often to one from a country of their choosing. That easily explains how they're getting through. IPs can also be spoofed.
Have you made your question relate to your board? As in a question that only has an answer on your board, such as "what's the last four letters of this board's name?" or something along those lines. Something a user can easily find browsing your site that a bot cannot search.
You can also create a sortables question and make users sort objects into categories correctly in order to register with an extension like this:
https://www.phpbb.com/customise/db/exte ... s_captcha/
As Brf as stated, the key to keeping them out is a good question.