Why isn't it enough to do the tracking/audit log in the server side? I can't imagine even the JP Morgan Chase CEO lives under surveillance of JP Morgan Chase Bank 24/7. Just require them to use centralized services and keep audit log of that? Sounds simple enough. I don't get the need to monitor all traffic. Surely the sensitive servers have audit log independent of network?
If you went through a proxy, they almost certainly did.
They didn't install TLS certs on my machine. My certs were the same ones I see on my home PC.