A large majority of 5XX responses can be an indicator of malicious activity. Under normal operations a web service should not be encountering errors. A majority of requests receiving 5XX responses means that the service is broken and someone may be trying to induce the errors on purpose.
An attacker who finds an endpoint that responds with a 5XX request may start probing that endpoint further to try and extract more information about the cause for the error and the system or to induce a fatal crash.
