Statistical Significance of Rolling Z-Score and Z-Score w.r.t. Central Limit Theorem I have a very fundamental doubt regarding the z-score and rolling z-score method. As per the central limit theorem: http://sphweb.bumc.bu.edu/otlt/MPH-Modules/BS/BS704_Probability/BS704_Probability12.html, the sample means are normally distributed if sample size >= 30.
In my case I'm using time-series data and trying to detect anomalies using rolling z-score. I am taking a window size of 15, to calculate my moving average and standard deviation, which is less than 30. But when I evaluate the anomalies through graph they seem pretty convincing and explainable. However, I am not able to understand the statistical significance of the rolling z-score method. How do I explain it to someone that although 15 data points is less than 30, but still the values to be normally distributed.
 A: Anomaly detection is often robust to distributional assumptions.  The basic assumption is (absolute value) big is bad. In many practical anomaly detection systems, the threshold is varied by the system operator, not the statistician.  Too many false positives? Raise the threshold.  Too many false negatives? Lower the threshold.  There is often work load management embedded in setting a threshold: Too many alerts? Raise the threshold. Too few alerts? Lower the threshold.
In your scenario, if the underlying distribution is normal, you are constructing $t$-scores, not $z$-scores because you don't know the mean $\mu_t$ or variance $\sigma^2_t$.  If $\mu$ and $\sigma^2$ is constant across time, as $t$ increases, your situation converges to knowing $\mu$ and $\sigma$, but you state

I am taking a window size of 15, to calculate my moving average and standard deviation

The central limit theorem does not apply in your case.  Limit refers to increasing the number of observations to $n \rightarrow \infty$.  Your scenario is $n=15$.
The thirty observations mentioned in the class notes you cite is a "rule of thumb" where the $t$-distribution often is "close enough" to the (standard normal) $z$-distribution for practical purposes.

when I evaluate the anomalies through graph they seem pretty convincing and explainable

Congratulations, you designed a practical application, although perhaps not an academically rigorous application.  You might enjoy reading the classic article:
Breiman, Leo. "Statistical modeling: The two cultures (with comments and a rejoinder by the author)." Statistical Science 16.3 (2001): 199-231.
A: Visually, you can plot z-scores for the 15-window size data against a normal distribution, and show it your claim is true.
Also, you can do a statistical test to prove that 15-window size data has a normal distribution as well.
