Toiletterider Modern cellular phones are full of intentional radiators and spurious radiators.
For example:
- cellular modem
- Wi-Fi transceiver
- Bluetooth transceiver
- NFC transceiver
- CPU clock(s)
- GPU clock(s)
- Touchscreen sensor
- DC-to-DC converter
All of these are allowed to briefly spew some crap into the air when power is applied to the device.
To make the sort of determination being sought would require the attention of somebody able to, for a given Pixel, locate the block diagrams for the radios (from, e.g., the FCC certification application), then find the data sheets for the parts, then figure out target frequencies to monitor for each chip, etc. Here is a link to the sort of information that it would make sense to deploy: https://discuss.grapheneos.org/d/16284-request-for-opinions-on-airplane-mode-is-a-myth/23
Another approach would be equipment capable of real-time capture of cellular transmissions, with some way to demodulate and parse the protocol frames. That's probably more expensive, but some repair shops might have some equipment that could do a reasonable job.