Squid should be able to that, and you can configure it so it doesn't actually cache anything, simply examine the traffic and log it. With that number of people, I'd recommend enabling the cache though. With forwarded-for enabled, it should log the originating IP, or even better - tie it in with your network authentication such as Microsoft ADS, OpenLDAP, etc. and it will also track the username. Either way, extra graphing and log file analysers are available from the Squid website to make pretty viewing and examining of data -
http://www.squid-cache.org
I suppose you might also want to look at whether completely unfiltered access is neccessary, and maybe some kind of content filtering should be brought it to restrict access to inappropriate sites during work hours...