Lookup what SQL connection string did the client use to connect

I have an onpremise SQL database server, to which, many applications connect to. Created CNAME record for the server and instructed users to change it in their app connection string too. Most of them will, but there will be some who don't, and will pose an issue. Therefor I wish to monitor the network if there is any app that's still try to connect to the SQL server via hostname, and not with the CNAME record. What is the best tool to monitor such traffic? -SQL profiler and extended event seems to have no knowledge about that information. -Wireshark can resolve IPs to DNS names, but not sure how it will know what connection string did the application use. -Monitor DNS queries on DNS servers maybe the most promising. All in all. What are the best tools to capture this information?