I found this answer from carbonize @
http://www.totalchoicehosting.com/forums/index.php?showtopic=21180&st=0&p=146125&#entry146125
Hmm I would be suprised if the spammers bothered to get your anti bot test question and put it in their script/program. The one thing I alway sask people who say they are getting spam even with the human verification is this, do you have another copy of either Lazarus or Advanced Guestbook on your server that is pointing at the same database as the copy you use on your site?