tgrep -w 'VP < (VBN $. (PP !<2 __)) @%
(AUX < (/^V/ < have|had|has|having))' | less
The heart of this search pattern is this part:
(VBN $. (PP !<2 __))
This matches a passive/past participle verb (VBN) that immediately precedes a PP sister. That PP sister, in turn, has only one daughter (i.e., the preposition). (!<2 means does not dominate as a second daughter, and __ is the wild card, so !<2 __ means does not dominate as a second daughter anything.)
The rest of the search pattern serves to weed out certain false positives. The main problem is that the tagging/parsing of the corpus does not distinguish prepositions with missing arguments from particles. This is compounded by the fact that VBN tags both past and passive participles. We could require the passive VP to be preceded by a form of be, but of course pseudo passives, like regular passives, need not appear with be. Instead, the pattern above weeds out cases where the putative passive VP is the complement of have.
Techinical note: @% is the alternative form for !$ (i.e., is not a sister of). For some reason, the shell interprets the string !$ before passing the command to tgrep.