Some things to consider:

• FTB (CA's tax agency) is really aggressive re: non-resident taxation because of people claiming Nevada residency (where there's no income tax) while working in CA to try to avoid CA income tax. Capital gains tax issues as well (avoiding CA capital gains on a single real estate transaction could represent hundreds of thousands of dollars of tax revenue). It's possible they monitor CC transactions to create a case for residency. Tourists don't get oil changes after all, and a tax agency has a valid use case for accessing financial transactional data.

• The article is vague. "Worked remotely for long stretches" doesn't tell us much. Long is relative. Was it a month? Was it years? Do we think the employee was likely very specific at his exit interview? California is pretty strict about new residents registering their vehicles in CA within 30 days, the employee could have either registered his vehicle or got pulled over and triggered an alert that way. Thinking about vehicles brings me to my final point:

• License Plate Readers. License plate readers can be used for (from the PDF for how San Diego uses the data): "LPR operation and access to LPR data shall be for official law enforcement purpose only." Tax law is a law. Further: "Law enforcement officers shall not share LPR data with commercial or private entities or individuals. However, law enforcement officers may disseminate LPR data to government entities with an authorized law enforcement or public safety purpose for access to such data." Emphasis mine. FTB is part of the tax law enforcement mechanism.

The employee could have been driving around on his <home state> plate, kicked off an "out of state plate observed for >30 days" alert, which then could kick off alerts with the DMV, FTB, and local PD.