Preferably, the pull up resistors should be connected to 3.3V. This will ensure that the PSoC's GPIOs operate at the same voltage as that of VDD.
If the Voh levels generated by PSoC for logic HIGH does not match with the master controller Vih level, then pull up resistors can also be connected to the 5V. Under this condition, the internal clamping diodes (refer GPIO cell diagram below) in the GPIO of the PSoC will limit the voltage on the SDA and SCL lines to (3.3V + Diode Voltage). The pull up resistors will also act as current limits which will limit the current through the clamping diodes. Design the Pull up resistors in such a way that the current through the internal clamping diodes is less than 5mA. This is applicable only when the SDA and SCL lines of the other I2C device are also configured as Open Drain mode.
When the above mentioned conditions are not met, then it is advisable to go for a level translator circuit.