Many international border crossings screen cargo for illicit nuclear material using radiation portal monitors (RPMs) that measure the gamma-ray flux emitted by vehicles. Screening often consists of primary, which acts as a trip-wire for suspect vehicles, and secondary, which locates the radiation source and performs isotopic identification. The authors present a method of anomaly detection for primary screening that uses past observations of gamma-ray signatures to define an expected benign vehicle population. Newly acquired spectra are then compared to this expected population using statistical criteria that reflect acceptable alarm rates and probabilities of detection. Shown here is an analysis of spectroscopic RPM data collected at an international border crossing using this technique. The raw data were analyzed to develop an expected benign vehicle population by decimating the original pulse-height channels, extracting composite variables with principal components analysis, and estimating variance-weighted distances from the "mean vehicle spectra" with the Mahalanobis distance metric. The following analysis considers data acquired with both NaI(Tl)-based and plastic scintillator-based RPMs. For each system, performance estimates for anomaly sources are compared to common nuisance sources. The algorithm reported here shows promising results in that it is more sensitive to the anomaly sources than common nuisance sources for both RPM types.