A few days ago, right after I posted my comment above, I created a function to add a JavaScript cookie to every post. I then used Nginx rules to return a 403 to anyone attempting to comment without that cookie present. I turned off Akismet.

I haven't seen a single spam comment since then.