Basically when a Bot attack occurs, if you have an AntiBot plugin in the server that kicks the bots in the PreLoginEvent, anyway when the bots gets kicked, they all trigger LuckPerms check, so basically if you have an antibot that kicks all the bots succesfully in the PreloginEvent, if you have LuckPerms installed it will crash the server as it will check for all that bot's permissions.

#967 may be related

The antibot plugin performs checks in the PreLoginEvent with the LOWEST priority, so it should be checking before other plugins does.

LP loads it's data during the async prelogin event - it will ignore connections cancelled during LOWEST.

https://github.com/lucko/LuckPerms/blob/f72a5cb6b5f66e571f9d800adb32cd6dc749f8a3/bukkit/src/main/java/me/lucko/luckperms/bukkit/listeners/BukkitConnectionListener.java#L99-L104