First up if you have not done so already you may want to consider virtual IPs. More reading here - http://support.citrix.com/article/CTX111898
That will give you network data to work with as you will be able to see what session is connecting to what. Next up you would need to monitor the traffic going to and from your Citrix servers. Either use flow capture if your switch supports it or setup a SPAN or mirror port. Looks like you have NTA already so you could use this to process the flows or if want want to look further into the traffic try something like LANGuardian. It does deep packet inspection to extract metadata from packets and integrates with Orion
NPM 11 may be another option if you are after application names and timing info.
As each session will have its own IP you can cross reference your AD logs to see what user is associated with the activity
Hope this helps,
Darragh