Can 2 VMs communicate if not on the same vSwitch

You'll need a VM, with connections to both vSwitches, configured to route traffic between the two networks.

It can be any OS you want, so long as it can perform IP forwarding/routing duties between the two networks.

Depending on your particular setup, you may want it to do other things as well (firewall or NAT for example) but without knowing more about your networks/subnets and routes I can't provide much insight.

Bridging the port groups to force all traffic through the pfSense VM is the right way.

However, if you use the pfSense to bridge between both port groups, each port group needs to have promiscuous mode allowed. A vSwitch doesn't need to learn a port group's (equiv. VLAN) MAC addresses, it knows.

Bridging requires being able to send and receive with the MACs from other VMs, so promiscuous mode is mandatory. The downside is that allowing promiscous mode works for the whole port group. As a workaround, you can use two port groups - one allowing promiscuous mode for the pfSense, one not for normal VMs - and connect them by assigning the same VLAN ID (the also need to be on the same vSwitch).

Note that there's no reason to use two vSwitches - a single vSwitch will nicely separate both port groups as well.

Additionally, a vSwitch works a bit differently than a physical switch. A physical switch would learn the bridged MACs on the pfSense's port. A vSwitch with promiscuous mode works more like a hub, so the pfSense receives all frames moved within the port group, not only those that need to be bridged.