Hello Juan
In the single rate three color case, the Be (excess burst) bucket is filled with tokens that spill from the Bc (committed burst) bucket. However, the Be bucket does not have to have the same amount of tokens as the Bc bucket. Indeed, the Be bucket size is typically set based on the specific burst speed that you want to achieve.
If an ingress packet is larger than the Bc bucket (like your 16000 bytes example with a CIR of 128 Kbps), it will indeed exceed the Bc and tokens from the Be bucket will need to be used. If the packet size also exceeds the Be bucket, the packet is marked as violating and is typically dropped or marked down depending on your policy.
However, this is an unlikely and undesirable scenario, as Be and Bc sizes are generally much larger than a single packet. These are typically set by the IOS based on the CIR and the intended burst rate and would avoid such a case.
In the scenario you described, the packet is not conforming it is exceeding. In this case, tokens are removed only from the PIR bucket. The tokens in the Bc bucket are untouched.
I hope this has been helpful!
Laz