But the official position of the company can’t be “everyone use the company’s resources as they see it for personal use”. So it’s best to just say company resources are for company. What if someone gets hurt using company machinery for personal use? In the US, that would be cause for the company’s workman’s compensation insurance premiums to increase. Why would an employer want that kind of headache?

In practice, from doing many of these investigations, no one bats an eye or gives a single shit about what kind of non-work activities you're doing. The visit to the ticket website would just be a few entries in a long list of other web visit entries, which we'd quickly scroll past while trying to find the thing we're actually looking for (usually malware-related traffic).