More details are need on the network and devices being used. You can probably trace network activity and put it against a time line to see if it’s done during work from his device If the device is company property you may have a case. Also if it’s being done using the company network. If it’s being done from another location outside of the company network and equipment it may be much harder to prove.. It may be possible that someone has his login credentials to Instagram and is abusing them for this purpose. Without access to the device, which may cause them to become suspicious, you may be in a tight spot.