What does his contract and the employee handbook say? If CTO includes being head of engineering at your small company, then having that set out in the contracts and handbook is part of your job.
The usual structure in contracts is that any work done with company resources, during work hours at the company, or directly in competition with the company by an employee belongs to the company unless otherwise agreed in writing by the employee and the company beforehand. If you don't have those terms, then the work belongs to you only if it is within the scope of his employment, but you need to talk to a lawyer to find out exactly how that is defined.
So that's the legal side. On the practical side, look at his work and your environment. Does his work consist of an hour of effort followed by four hours of waiting for a huge job to run, followed by another hour of effort? If so, letting him work on side projects could be a reasonable accommodation. One of my professors describes not being allowed to study during an internship while jobs were running (back when jobs were submitted to mainframes), so he sharpened pencils down to nubs to look busy.
If you've ended up with a culture and work schedule where people are there for long hours, then allowing side projects as a stopgap until you fix your environment might be reasonable. I mention this because long hours based on machismo, not reality, is a common dysfunction at startups. Remember: most engineers have three to five hours of sustainable, hard mental work a day.
On the other hand, if you have someone who isn't constrained by waiting for a resource for long periods of time, and who is working a sensible day of 9AM to 4PM or equivalent, then you need to sit down and find out why he is doing this. If it's at the expense of work for the company, then fire him. He isn't fulfilling his fiduciary responsibility to the company. But really try to understand. As an executive, you will be the last to know what's going on. He may be doing this because he's entirely blocked, or he's burned out, or you are unaware of social problems in the company and he's planning his exit, or he doesn't regard you as someone he has to listen to for some reason, maybe because he thinks you're incompetent, or he has a different understanding of the politics and power at the company than you do.