Since the users have root access, nothing you do on the machine itself is trustworthy. You should use a traffic sniffer that is configured to see all of the traffic to and from the server under observation (by setting up a monitor port in a smart ethernet switch). A traffic sniffer won't be able to decrypt the contents of any SSH session, but it can see the quantity of data exchanged, and that's all you're interested in.
I can think of two ways to correlate TCP streams observed on the traffic sniffer with users.
If you can identify which user the traffic belongs to by the IP address of the remote system (the SSH client), for example, if the clients all have static IP addresses, use that.
Otherwise, configure remote syslog on the server under observation and get the information from the authentication log on the remote syslog server. OpenSSH logs a message like this every time a session is opened:
Feb 15 12:04:59 OZoNE sshd: Accepted publickey for **** from *.*.*.* port 48025 ssh2
Because the TCP port number and username are both found in the syslog message, you can identify which user the TCP stream (as captured by the packet sniffer) belongs to.
For the second solution, there is still an opportunity for the users to compromise the system. Since they have root access they can modify the log messages that get sent to the remote syslog server if they really want to. Still, using a remote syslog server makes it a little more challenging for the users to interfere with the logging, and impossible to do it after the fact.