The rentacops that provide security at my office all work for a big real estate mgt company. They all use handitalkies for comms. I have a Baeofeng uv5r and have monitored all the frs, gmrs, and murs freqs and have not found them yet. What am I missing?

They might be on one of the business band freqs.  The most common are the 'dot' frequencies, so look there first.  Red dot, blue dot, yellow star, etc.  Look them up and scan through.  If that doesn't get you their freq, find someone with either a frequency counter or a Uniden scanner with the Close Call feature.

I used Close Call to get my apartment complex's maintenance freq when I lived there.  Made for some interesting listening.  It turned out they were on Yellow Star freq, using a CTCSS tone.  The uniden scanner determined both for me.

I have a couple scanners that have a "smart seek" mode on them.  They'll scan all frequencies in whatever bands you tell them to, and stop when they pick up something.  Have to be sort of close to the signal, but not right next to it.  You could also do an FCC search for the company they work for, if it's a business license, they'll be on file, as well as locations and frequencies.  I found an unlicensed repeater near my work by doing that.  Found out it was a very-expired Mobil chemical repeater that is now used by Pactiv.  They finally got a new license for it a couple years ago.

The other thing you could do is used a frequency counter or near field receiver to detect the frequency. You'd need to be near one of the folks transmitting though. Once you have the freq, you can tune in and see what you hear. If you hear what sounds like loud static starting and stopping, they're on a digital system. Listening it gets a bit more complicated at that point, but is likely possible.

Look them up here!!

https://www.radioreference.com/

1. Try to get a look at their radios when you get a chance. They are probably using motorola or vertex radios, which could sound like garbage/modem noise on your end. You would need to use a USB RTL-SDR dongle or two to listen to them.
2. As others have said, check the FCC database for the real estate company's name, and the security company's name. That should give you an idea of the frequencies and the tech they are using.
3. They'll likely be on the higher commercial side of UHF.  450-460/470-520mhz, but anything is possible.
4. Pay close attention around +/- 5 minutes on the hour, that's when radio checks will usually happen if they do.

Found them on fcc, license is wqnj892. Emission type is 7k60fxe which apcointl.org says means

2-slot DMR (Motorola MOTOTRBO) TDMA voice

I guess this is beyond the capabilities of the baofeng as it sounds like a motorboat on their main freq of 422.325.

They make scanners that will get mototrbo.
You could probably buy a used motorola HT cheaper & have it programmed to that freq, assuming you know the rest of the info.

A $20 RTL SDR and DSD Plus (free) will listen to it no problem.

Correct. They may even be employing some type of channel privacy (voice inversion) as well.

Agree. Probably maybe Capacity plus.

Thanks for feedback. Have a SDR on the way (damn these are cheap!) so I'll give it a go next week.