As Cyber-Physical Systems (CPS) such as water treatment and distribution systems grow in scale and complexity, their operational technology becomes computationally heterogeneous, spanning from resource-abundant cloud platforms to resource-constrained edge devices. This fundamental diversity challenges the deployment of a single, effective anomaly detection solution, creating a significant architectural dilemma for critical infrastructure operations. Deep learning methods achieve strong anomaly detection capability, but they are often too heavy for resource-constrained edge devices. Although lightweight models can reduce the demand for computing resources, their detection capability also decreases. To address these issues, this paper proposes Transformer-based Anomaly Behavior Analysis for Cyber-Physical Systems (TABA-CPS), a holistic architecture designed to address this conflict through its flexible dual-mode deployment strategy. At its core is a novel Expectation-Maximization Anomaly Transformer (EM-AT) model, an extension of the Anomaly Transformer (AT) that automatically sets the detection threshold, eliminating manual inspection. TABA-CPS offers a flexible, dual-mode deployment strategy: a Performance mode for environments with enough computational resources, which maximizes anomaly detection accuracy and enables Large Language Model (LLM)-based anomaly behavior investigation; and a Computational Resource-constrained Edge (CRCE) mode for resource-constrained devices (e.g., Raspberry Pi), which utilizes model quantization and the ExecuTorch runtime to deliver efficient, low-latency inference. Additionally, the architecture introduces the Green-Water System Anomaly Detection Evaluation (Green-WSADE) framework, inspired by the Green AI idea, to evaluate overall performance on different devices. Experiment results show that Performance mode achieves F1 scores of 96.32% and 92.47% on Secure Water Treatment (SWaT) and Water Distribution(WADI) datasets, respectively, surpassing leading methods. CRCE mode significantly lowers computational resource consumption, including a 41% reduction in average inference power with only a marginal F1 score drop (about 0.14% on SWaT, 0.11% on WADI). Moreover, the CRCE mode consistently achieves a computational resource efficiency grade of 1 to 3 across heterogeneous edge devices under the Green-WSADE framework, achieving superior resource efficiency compared to Performance mode on identical resource-constrained hardware. The results demonstrate that TABA-CPS delivers accurate and rapid on-site anomaly detection at the network edge while lowering resource usage, supporting long-term, reliable operation in water treatment and distribution systems.