I ALREADY had reCaptcha enabled in civi and on my Profile type, but it seems that spam bots were still making submissions to civiCRM and creating contacts (and got assigned to a group).
I only recently caught it because I turned on role synching between civi and drupal and saw spam accounts popping up assigned a role other than "authenticated".
After going back through the particular group in question (in civi), I noticed that there were contacts that had civi IDs but not Drupal (I'm assuming submissions before I turned on role syncing. I didn't load sample data when I installed civi)
I'm not even sure what the URL would be for the form where bots could create a contact record...