Google Analytics doesn’t exclude bot (spider) traffic by default. So the first thing I change when setting up a new analytics property (or view to be more specific) is to exclude bot traffic.

It’s accessible from Admin > View > View Settings near the bottom.

Another useful settings is “Exclude URL Query Parameters” where I add fbclid.

And while you’re here you can take a look at Admin > Property > Tracking Info > Referral Exclusion List where you can add spam referral domains.