But you don't really own your WordPress. No way to get around using their services if you want to have proper spam filtering.

Sure you can. There are multiple anti-spam plugins out there, and unless you're running a super large high value target, most spam won't be custom made, so very simple things like hiding the "URL" field with CSS and marking as Spam when something has been entered will get rid of 95% of it.

This works well enough for comment spam filtering: https://wordpress.org/plugins/antispam-bee/

(or just disable comments)