Sorry for bringing back an old thread, but I just ran into this issue with our 1602 upgrade & migration from our SCCM 2012 R2 CU4 environment. In client.msi.log we were getting the same error as above.
We also use Verdasys Digital Guardian and after terminating the agent, the client install went on without a problem.
Niall, to answer your question, DG is DLP software that uses filter drivers to lock down the OS. It is very deep-level and causes alot of issues for us most of the time. It has very stringent security and can be used to limit network connections, prevent file/folder access, disallow processes, etc. Our security team loves it!