Did you configure ReCaptcha? See https://docs.pkp.sfu.ca/admin-guide/3.3/en/securing-your-system#managing-spam
For removing users, see https://docs.pkp.sfu.ca/admin-guide/3.3/en/securing-your-system#cleaning-lots-of-users
You may also search this forum for hints and SQL queries to identify spam registrants, see e.g. here: Removing spam registrants