Where to send voltage peaks while ESD-protecting a subcircuit? To a subcircuit Vcc or to a global circuit Vcc?
Datasheet page 2: Typical application.:


  Vref1 is connected to GND
  
  Vref2 is connected to Vcc.


The question is what is the IO voltage? You should connect to a Vcc voltage that is a least higher than the max voltage into the IO you want to protect.

And it might be very good to add a decoupling cap between the Vref2 pin and the GND plane to provide a path of small impedance for high frequency signals (such as a spike...). This, with all the caps on the VCC plane, should protect your other parts connected to that Vcc.