Did you report it to the police yet?

The problem here is the insertion of malicious code into the source code itself which compromises the RNG. Unless you inspect it yourself, any scripts will be vulnerable to this. The issue here is not with the machine being online. I don't see the point of using a vanity address generator when OP was specifically generating a paper wallet and vanity gen AFAIK doesn't convert the keys into a paper wallet by itself.

The once trusted website Bitcoin Paper Wallet Dot Com (no clickable link because I no longer trust the site) got sold and now has several scam accusations against it. Bitcointalk user bedla tested it and 24 out of his 100 generated addresses already had a balance. That means the scam is still going on.

My crazy idea:

• Get private keys from the site, on a regular basis if they change something
• Setup a system to sweep all keys the moment they get funded
• Send funds/dust to an addy that leaves a hint to find this topic
• Return the funds to the owner after signing a message from the original sending address

Step 2 is where I don't know how to do it (yet), but I do know there are brain wallet hunters out there who use a similar system to steal funds.
Step 4 is the tricky part: if for instance the funds come from an exchange, the owner won't be able to sign a message. But if I don't do this, the site owner will take the funds for sure so I consider this a white hat thing to do.

Should I pursue this?

Should go to Scam Accusations/Investigations, it's not a technical support thread. Make sure you don't dox the wrong person, the ownership was changed before it became a phishing site.

Anyhow, it seems to be the site which generates address with weak/predictable RNGs and thus allows it to be compromised easily. Don't think you can really do much about it, unless you find the current owner.