I have seen plenty of manually added spam comments with Gravatars, I think I saw the first one in 2013. At first I wasn't sure it was spam, but when I Googled the domain they used, yuppers, 'twas spam.

Currently, I use a combination of WordPress Zero Spam and WP Spamshield. Spamshield is better for comments, giving me the option of allowing pingbacks (where Zero Spam blocks it all without giving me the option to choose), but Zero Spam will protect Gravity Forms where Spamshield does not.

Have been slowly removing Akismet and keys from sites ever since.