Interesting idea. Edge AI for initial anomaly detection before sending data to the central system makes sense. However, how do we handle global-level anomalies that require a broader perspective?

Centrally. If your system have K finite modes of behavior (degrees of freedom), then you can compress it as some combination of these effects.

Due to Donoh-Tanner Phase transition theorem, you can almost-surely reconstruct a lower dimensional (K-dimensional) manifold immersed in a N-dimensional space with O(k log N) points. For many real world systems, K << N. Now, K is the degree of freedom of your system, N is the size of your sample, or the inverse of the frequency resolution you need to capture anomalies (that's your sampling rate if you were sampling metrics at regular intervals, but here we are not). So you can capture random projections of your system, compare the results to the predictions of a pre-computed compression model of your system and only ship the changes. Low-dimensional projection maintains correlations (and introduces spurious ones), which can be used already in compressed forms for some central anomaly detection (e.g. how many replicas are affected by the same traffic).