From the microsoft.public.softwareupdatesvcs newsgroup
When you install SUS, IISLockDown and URLScan will be installed as well, unless one (or the other) is already installed. Once URLScan is installed, it is configured to reject certain requests. It shouldn't be considered a problem at all, unless it's rejecting requests that you actually need to come through for other web applications to function.

Contributed By: Wayne Flynn, MVP SUS [28/01/04]
This is not necessarily a problem. Look at the URLScan logs (c:\windows\system32\inetsrv\urlscan). In there you'll find precisely what was blocked. It's probably something innocuous, but if it's blocking .EXE files that your client computers are trying to download, then you'll need to fix that problem in URLScan.ini