There are a lot of variables here, but the key is that this isn't an XF error message so it's very unlikely that it's generated by XF. If it's generated by the web server, the request is never getting to XF.
It's probably some sort of false positive on an anti-DoS configuration, as add-on installation will involve a number of page refreshes.