What are the chances that this could be used for a DoS attack and how
serious would that be?
The chances are good. If a specially crafted request causes an unusually long waiting time that's a good indicator that you're occupying a thread on the server and found a potential Denial of Service attack vector. DoS bugs often get overlooked in web applications but there are quite a few ways in which they can occur (SQL wildcard attacks, pending network requests, etc.). Against many web frameworks there have been published advisories on DoS flaws, like this one for Wordpress.
The severity obviously depends on the service they're running. A small web shop could lose a few potential customers - on the other hand, for a bitcoin trading site it could result in great money loss.
I'm asking because I'm hesitating to submit this bug to the app owner
who is running a bug bounty program as I do want to avoid negative
Bug Bounty Programs often explicitly exclude DoS vulnerabilities from their scope. But that doesn't mean they're not interested - rather, vendors are often afraid to encourage attacks which would likely impact their services (which a DoS clearly does).
I would still report it. BBPs have rewarded DoS flaws in the past, for example here or here. I'd clarify that you have not actively been looking for DoS bugs but found behavior that strongly indicates that a DoS attack vector might be there. I'm sure they're interested to have a look at this if they recognize you as a responsible researcher.
There is also this OWASP guide on testing for DoS vulnerabilities, but as said, I wouldn't actively do it without permission. That wouldn't be the first time someone got banned from a BBP.