Is it tough to apply for a CS PHD degree after several years in industry?

It sounds like you have many industry experiences that would look really good on a PhD application. To be blunt though, your GPA is pretty bad. If I was reviewing your application, I would worry that you are one of those students who is very capable, yet also not very focused. Experience has taught me that students who show immense promise (publications, awards, test scores), yet have really poor GPAs, rarely amount to much as graduate students in the modern system.

While this may or may not describe you, students with low GPAs tend to also be the students who struggle to get to their teaching assistant duties on time and who cause administrative nightmares for the graduate committee. (E.g. failing all classes, but arguing that they should still be retained as a graduate student because they think they have a great dissertation). I'll admit that I personally only recommend PhD applicants below a 3.0 GPA for further review by the graduate admissions committee under very rare circumstances. (E.g. they overcame cancer or something). When I am reviewing applicants, low GPA is one of the easiest metrics to immediately discard an application.

What to do:

Your industry experience should be emphasised as an indicator that your GPA is not reflective of what type of PhD student you will be. Your letters of recommendation need to speak to your work ethic and dedication specifically. These are the very best things you can do. I would be much more willing to overlook a poor GPA if everything else was very promising for the applicant (GRE, publications, letters of recommendation, industry experience, in person interviews).

If you have external funding, some programs are much more willing to take you on. (If you are willing to pay the tuition, why would they turn you down? It's low risk for them).

I would also consider applying for master programs as a means of "proving" yourself to PhD programs down the road.