This is actually illegal, and the information you have provided is enough to get a search warrant in the U.S. I have forwarded this thread to my local FBI field office. Have a nice day :)
When your employees bring a WFH device into their home, and your spyware collects metadata on their keystrokes, you are in violation of federal wiretapping law as you are collecting metadata from within their private home network and exfiltrating it through connections not initiated by the employee and without their consent or notification.
By law you must indicate to your employees that you collect metadata on their keystrokes (under privacy laws, this is still just private information in aggregate). Every time one of your employees enters private information or logs into their bank on their WFH device, and you log your metadata on these keypresses, you are committing another felony. Even the DoD has to provide a warning every time you log into a DoD system describing the surveillance being used on the device.
Depending on your employees' locations, this may also be a GDPR violation.
There are also numerous export control laws governing surveillance software that you may or may not be in violation of depending on your location. This is why obtaining this kind of software is difficult, especially in the EU.
People like you should be afraid, not your employees.