keys from outside and lock all the doors, forcing me to either ring the doorbell or knock loudly enough to wake them up to be let in, followed by a nice, long, uncomfortable chat and possibly a grounding.

If you've made the rule that location should stay on on their phones then turning location off is a separate issue from sneaking out, which to me would warrant the loss of the phone for a period of time. If not, smart kid.

I'd definitely say a chat is warranted to find out what/where and determine if any other consequences need to be added. If this is an isolated incident I'd go easy but if it's a pattern use your best judgement how to handle it.