It does use your CPU. Unfortunately, it seems like bots will have no problem doing the CPU cycles that a mobile client or browser would have to do.. I think the better way to prevent spam is to use lightning payments (because that actually costs the bot something)