Monitoring work from home

My boss has asked me if there is a way to see just how "busy" people who are working from home are.  I have this data in Sentinel:

Entra sign-in logs

Defender for Endpoint logs

Office 365 logs

Most, if not all, on premise AD login events

Netskope (current ZTNA solution) logs

I have my known office location IPs so i could just exclude those and look for activity from other IPs however many times people will work in the morning or on the way to work appearing from a non corporate IP, come into the office appearing to come from a corporate IP, and then from home again in the evening. 

I need a way to query Sentinel looking for people who appear to be working but not coming from Corp IP.  If they came from different IPs on the same day including Corp check to see if those non Corp are before and after business hours and exclude those.

Anyone know of a good query to achieve this?  Or maybe a tool that can extract and generate a report?