Catchalls in mail domains today are somewhat brave. In addition to all the mail coming in to fake addresses, you then have the spam harvesters who can't tell a message-id from an email address, etc, and all those mails can come in too.
Honestly, it's better to use:
- Aliases, set up in the accounts page, you can create lots of aliases
- Variant address forms. Gmail supports firstname.lastname@example.org addresses, and also canonicalises away dots, so that email@example.com == firstname.lastname@example.org == email@example.com
- Addresses with a reasonable length left-hand-side. Much as it pains me, as a three-letter initial sort of person, there's a reason Google don't allow such short addresses in @gmail.com; they really do receive a lot more spam from just random dictionary probes.
If you try excluding some addresses by filtering them aside then you just end up with more and more complex filters, which are a pain to keep up-to-date and if you're not careful might catch too much.