It could be possible to write some custom fail2ban rules to 95% solve this (ie with a short "findtime"). There might be edge cases with CGNAT and scripts but you can likely mitigate this by being specific about the form page to scan for, and it should be practical if your form is not getting 1000s of hits per hour from a targeted group. That said, Id only look at this type of solution if you cant modify the website code.
It would seem to me to be relatively straight forward (if your site is using something like php) to set a cookie/session for each form view which tracks the request time in seconds since the epoch. Some trivial code in the form could do a time comparison on the form processing to know if its spam.
An alternative solution to stymie a simple bot of the type that doesn't implement a wait is a captcha - even a trivial one.
With respect of the practicality of a spambot waiting before submitting a form, this would not be hard, and any half decent programmer could do this without a significant performance impact to the bot using multiple threads - of-course this does not mean they do.