I think flash is the culprit here. I installed the first one (i.e., the one for systems other than el capitan) and immediately got a message to update flash. So I updated the flash.
Whilst I accept there is still a need for xprotect it seems to get updated far more often than necessary, based on other stuff other than flash and java.
These two security hazards basically dominate the majority of xprotect updates.
I don't know about you, but I'm sick of the cat and mouse game with flash and java security updates. The sooner we are rid of these the better. They are both outdated technologies and they are really more trouble than they are worth thesedays.