How to Address a Suspicious Employee's Malware Issues?

I'm facing a tough situation with an older IT technician who's been with the company for over 20 years. When I joined, he was on a long sick leave, but upon his return, he started going through old CDs. I didn't think much of it at first, but one of the CDs contained a malware called mimikatz, which raised alarms and led our SOC team to investigate. When I asked him about it, he claimed he had no idea malware was on the CD. After another employee verified the contents, we found that mimikatz was indeed the only harmful item among various files. Now, things have escalated: he has a honeytoken flagged, has basic malware, and a keygen cracking tool on his PC. Although we did a full virus scan, it only showed a VBS script, making me wonder if he deleted the other files first or intentionally planted the script as a distraction. I really suspect poor work ethics—this isn't 2002 anymore—but I'm also puzzled about whether there's malicious intent behind his actions. How should I approach reviewing this situation with him, and what specific questions should I ask to dig deeper?