In a given anomaly window only the first anomaly indication is counted. Is the threshold calculation taking this into acount ? I could not see that in the code after a quick look. It might impact the scores if the algorithm for finding the threshold is not accounting for early anomaly indications masking later anomaly indications in the same window.