Not worth the effort, it is just a job, why make it so hard to yourself. If your boss knew the problem for a long time but took no action, why you got so excited?
The biggest mistake you have made is telling him don't fake sick, this will get you in trouble and HR won't help you too.
My suggestion is just tell him that company policy is such such, then sending emails to HR and copy CTO asking if XXX wants to do this, will it be in complience with company policy? Then follow whatever HR told you. If he really does something wrong, HR will catch it and you will have basis for further action, otherwise, you cannot do anything to him.
